EUVD-2026-20375
GHSA-wgx8-mfg5-p253
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-497 is a confidentiality-only information disclosure flaw; C:L/I:N corrects the apparent metric inversion in the provided vector.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
4DescriptionCVE.org
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Retrieve Embedded Sensitive Data.This issue affects BSK PDF Manager: from n/a through <= 3.7.2.
AnalysisAI
BSK PDF Manager WordPress plugin versions through 3.7.2 expose embedded sensitive data to unauthenticated remote actors via a network-accessible endpoint, classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). The flaw allows retrieval of sensitive information embedded within managed PDF files or plugin internals without any authentication, affecting all deployments of the plugin up to and including version 3.7.2. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.02% (5th percentile), indicating low near-term exploitation likelihood despite the zero-barrier attack profile.
Technical ContextAI
BSK PDF Manager (CPE: cpe:2.3:a:bannersky:bsk_pdf_manager:*:*:*:*:*:*:*:*) is a WordPress plugin by bannersky used to manage and display PDF documents on WordPress sites. CWE-497 describes a scenario where the software exposes sensitive system or application information - such as file paths, metadata, configuration details, or document content - to actors outside the intended trust boundary. In this case, the plugin likely fails to enforce access controls on one or more endpoints or file-serving mechanisms, permitting unauthenticated users to retrieve data embedded in PDFs or exposed by the plugin's internal handling logic. Patchstack, the reporting source, specializes in WordPress security and commonly identifies information leakage in plugin REST API endpoints, AJAX handlers, or direct file access patterns.
RemediationAI
Update BSK PDF Manager to a version above 3.7.2 once a patched release is published by bannersky; no specific fixed version number is confirmed in the available data, so administrators should monitor the WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/bsk-pdf-manager/vulnerability/wordpress-bsk-pdf-manager-plugin-3-7-2-sensitive-data-exposure-vulnerability for a confirmed patched release. If an update is not yet available, a compensating control is to restrict public access to the plugin's file-serving endpoints or AJAX handlers via server-level rules (e.g., nginx location blocks or Apache .htaccess directives targeting plugin-specific URL patterns), though this may break intended PDF display functionality. Alternatively, deactivating the plugin until a fix is confirmed eliminates exposure with the trade-off of losing PDF management capability. Sites that store sensitive or proprietary documents via this plugin carry elevated risk and should treat deactivation as the preferred interim measure.
More in Bsk Pdf Manager
View allThe BSK PDF Manager WordPress plugin before 3.1.2 does not validate and escape the orderby and order parameters before u
Multiple SQL injection vulnerabilities in inc/bsk-pdf-dashboard.php in the BSK PDF Manager plugin 1.3.2 for WordPress al
Stored Cross-Site Scripting in the BSK PDF Manager WordPress plugin version 3.8 and earlier allows authenticated contrib
The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bsk-pdfm-category-dropdown' s
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today