CVE-2025-14074 is a missing authorization vulnerability in the PDF for Contact Form 7 + Drag and Drop Template Builder WordPress plugin by addonsorg. The issue arises from the lack of a capability check in the 'rednumber_duplicate' function, which enables authenticated users with Subscriber-level privileges or higher to duplicate any post, including private or password-protected content. This vulnerability affects all versions up to and including 6.3.3. The CVSS 3.1 score is 4.3, reflecting a medium severity impact primarily on confidentiality due to unauthorized duplication of posts. No patch or remediation details are currently available from the vendor or advisory sources.

An attacker with authenticated access at Subscriber level or above can duplicate arbitrary posts, including sensitive content such as password-protected or private posts. This could lead to unauthorized disclosure of content by creating copies accessible to the attacker. There is no indication of impact on integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and monitor for suspicious activity related to post duplication. Avoid granting Subscriber-level or higher access to untrusted users. Follow the vendor's updates for any forthcoming patches or official mitigations.