What is the CVSS score of CVE-2026-12407?

CVE-2026-12407 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of E2Pdf WordPress Plugin are affected by CVE-2026-12407?

The E2Pdf WordPress plugin (versions ≤ 1.32.26) contains a privilege escalation vulnerability enabling user accounts to gain unauthorized administrator access, threatening all affected WordPress…

How to fix or mitigate CVE-2026-12407?

24 hours: Inventory all WordPress installations using E2Pdf plugin; document version numbers; audit and document which users hold the e2pdf_templates capability; scan admin logs for recent unauthorized account changes or administrative actions by low-privilege accounts. 7 days: Disable or remove the E2Pdf plugin from all installations; if plugin functionality is critical to operations, restrict e2pdf_templates capability to a single senior administrator with enhanced monitoring and implement daily permission audits; contact hosting provider if using managed WordPress services. 30 days: Subscribe to vendor security channels; upon patch release, test patch in non-production environment and deploy to production.

E2Pdf WordPress Plugin CVE-2026-12407

EUVD-2026-37836 HIGH

Missing Authorization (CWE-862)

2026-06-18 Wordfence

GHSA-cg97-5gg4-vc94

WordPress Authentication Bypass Wordpress Plugin E2Pdf Export Pdf Tool For Wordpress

8.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable admin endpoint (AV:N), no special timing (AC:L), requires a low-privilege authenticated account with delegated capability (PR:L), no admin interaction (UI:N), and arbitrary option overwrite yields full site compromise (C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 18, 2026 - 04:43 vuln.today

CVE Published

Jun 18, 2026 - 03:41 cve.org

HIGH 8.8

DescriptionCVE.org

The E2Pdf - Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.32.26. This is due to the screen_action() function lacking a dedicated capability check and nonce verification - when invoked via the ?action=screen routing path the controller's index_action() nonce gate is bypassed entirely - while reading an attacker-controlled option name and value from $_POST['wp_screen_options'] and passing them directly to update_option() with no allowlist, relying solely on the page-level e2pdf_templates capability which the plugin's own Permissions UI allows administrators to grant to any role including Subscriber, Contributor, Author, or Editor. This makes it possible for authenticated attackers, with a custom role that has been granted the e2pdf_templates capability, to overwrite arbitrary WordPress options such as default_role and thereby escalate their privileges to administrator.

Articles & Coverage 1

News 3 New WordPress Vulnerabilities - 3 High Severity Jun 19, 2026

AnalysisAI

Privilege escalation in the E2Pdf - Export Pdf Tool for WordPress plugin (versions ≤ 1.32.26) allows authenticated low-privilege users with the e2pdf_templates capability to overwrite arbitrary WordPress options and elevate themselves to administrator. The flaw stems from the screen_action() function lacking a capability check and nonce verification, letting attackers pass attacker-controlled option names and values directly to update_option(). No public exploit identified at time of analysis, but the issue was disclosed by Wordfence with detailed source-line references making weaponization straightforward.

Technical ContextAI

The vulnerability sits in classes/controller/e2pdf-templates.php where screen_action() handles the ?action=screen routing path. Because this code path bypasses the controller's index_action() nonce gate, it never verifies a WordPress nonce and never re-checks capabilities beyond the page-level e2pdf_templates capability. That capability is exposed in the plugin's own Permissions UI, where administrators can (and are encouraged to) grant it to Subscriber, Contributor, Author, or Editor roles. The handler reads $_POST['wp_screen_options'] as an arbitrary key/value pair and passes it straight to update_option() with no allowlist, which is a textbook CWE-862 (Missing Authorization) issue affecting any WordPress option - including security-critical ones like default_role, users_can_register, siteurl, and active_plugins.

RemediationAI

Upstream fix available (changeset 3574750 in the WordPress.org plugin repository); a released patched version is not independently confirmed from the supplied data, so administrators should update to the latest available E2Pdf release published after the 1.32.26 changeset and verify via https://plugins.trac.wordpress.org/changeset?old=3574750%40e2pdf. Until a tagged release is confirmed installed, immediate compensating controls include opening the plugin's Permissions UI and revoking the e2pdf_templates capability from all non-administrator roles (this disables E2Pdf template management for those users but eliminates the attack surface), or temporarily deactivating the plugin entirely. As a WAF-level mitigation, block POST requests to admin URLs containing both action=screen and a wp_screen_options[] parameter targeting the E2Pdf templates page; this preserves PDF rendering for end users but prevents the screen-options write path from being abused.