e2pdf WordPress Plugin CVE-2026-66710

Exploitation requires no authentication (PR:N per CVSS vector) and no user interaction (UI:N), meaning any remote attacker with HTTP access to the WordPress site can attempt the attack against e2pdf <= 1.32.40. However, the CVSS AC:H metric confirms that additional specific preconditions must be met beyond simple network reachability - for this LFI class, this most likely means the attacker must be able to place attacker-controlled content on the server filesystem (e.g., via a file upload feature, log injection, or session file manipulation) to escalate from file disclosure to code execution. Limiting factors: AC:H reduces the likelihood of mass automated exploitation; the scope is unchanged (S:U), meaning the vulnerability does not inherently allow pivot to the underlying OS or adjacent systems beyond the PHP application context; and sites that disable file upload capabilities reduce the RCE escalation path. The exact internal plugin parameter or feature triggering the inclusion was not specified in available data.

The CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a high-severity flaw with no authentication barrier and network accessibility, tempered by High Attack Complexity. AC:H is the primary risk-moderating signal: LFI-to-RCE chains typically require an attacker to first place a controlled file on the server (e.g., via an image upload or log injection), which is an additional step beyond simply sending a crafted request. For sites that also permit file uploads, this two-stage attack is feasible, elevating real-world risk considerably. No EPSS data was provided in available intelligence, and the vulnerability is not listed in CISA KEV, suggesting it has not seen broad confirmed exploitation at time of analysis. No POC exploit was referenced. The absence of EPSS and KEV data limits confidence in quantifying real-world exploitation likelihood, but the unauthenticated network vector against a WordPress plugin with a meaningful install base warrants prompt remediation rather than wait-and-see posture.

An unauthenticated attacker sends a crafted HTTP request to a WordPress site running e2pdf <= 1.32.40, injecting a malicious file path (e.g., a traversal sequence pointing to wp-config.php or a server log file) into a vulnerable plugin parameter. If the server's PHP include() or require() processes this input without sanitization, the attacker can read arbitrary files - and if they have previously uploaded a PHP-containing file (e.g., a polyglot image), they may escalate to remote code execution. No POC has been identified in available intelligence, but the attack pattern is well-understood for CWE-98 class vulnerabilities.