What is the CVSS score of CVE-2026-12124?

CVE-2026-12124 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

PDFDraft CVE-2026-12124

EUVD-2026-49689 MEDIUM

Missing Authorization (CWE-862)

2026-07-28 Wordfence

GHSA-vqr6-98r6-wqvg

WordPress Authentication Bypass Wordpress Plugin Pdfdraft Drag Drop Pdf Builder Pdf Viewer Embed Download Pdf Certificate Invoice Designer Wpeverest

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

No authentication or user interaction, network accessible, low complexity, only low confidentiality impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 06:53 vuln.today

CVE Published

Jul 28, 2026 - 05:39 cve.org

MEDIUM 5.3

DescriptionCVE.org

The PDFDraft - Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax() function and the serveTemplatePdf() REST route (which is registered with permission_callback => '__return_true') in versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to download stored template PDFs - which may contain customer PII, invoice, order, and certificate data - by requesting the publicly registered admin-ajax action pdfdraft_embed_pdf or the REST endpoint /wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf with a known or guessable design slug, bypassing the plugin's own .

AnalysisAI

Unauthorized data access in the PDFDraft WordPress plugin allows unauthenticated attackers to download stored template PDFs containing customer PII, invoices, orders, and certificates. This is due to a missing capability check in the serveTemplatePdfAjax() function and the REST route registered with __return_true, affecting versions up to and including 1.1.0. No public exploit or active exploitation has been identified at the time of analysis, and the CVSS base score of 5.3 reflects the moderate but easily exploitable nature of the issue.

Technical ContextAI

The vulnerability resides in WordPress plugin 'PDFDraft - Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer' (CPE: cpe:2.3:a:wpeverest:pdfdraft_-_drag_&_drop_pdf_builder,_pdf_viewer,_embed_&_download_pdf,_certificate_&_invoice_designer:*:*:*:*:*:*:*:*). The plugin uses WordPress AJAX actions and REST API endpoints to serve template PDFs. The function serveTemplatePdfAjax() (hooked to admin-ajax action pdfdraft_embed_pdf) and the REST route /wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf lack proper capability checks, with the REST route explicitly using permission_callback => '__return_true' to allow unauthenticated access. This is a classic CWE-862 Missing Authorization flaw where the application fails to enforce access control before serving sensitive data.

RemediationAI

The primary fix is to upgrade the PDFDraft plugin to version 1.1.1 or later, as evidenced by the Trac changeset that adds capability checks to the affected functions. Users should update via the WordPress admin dashboard or by downloading the latest version from the WordPress plugin repository. If immediate patching is not possible, as a workaround, administrators can restrict access to the REST endpoint /wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf by adding an IP whitelist or a custom authentication check via a WordPress mu-plugin, but this may break legitimate functionality. Additionally, reviewing and removing any sensitive data from template PDF files would reduce exposure; however, this does not address the underlying vulnerability. Side effects of the workaround include potential denial of service for legitimate users and added maintenance overhead.