EUVD-2026-43478Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running PDF Generator <=1.6.2
-
DeliveryLocate PDF-generation endpoint accepting a URL
-
ExploitSubmit crafted internal/metadata URL
-
ExecutionServer fetches attacker-chosen destination
-
PersistRetrieve internal response or trigger internal request
-
ImpactPivot to cloud metadata or intranet services
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reaching the plugin's server-side URL-fetch/PDF-rendering functionality with an attacker-controlled destination URL; the source CVSS vector (AV:N/AC:L/PR:N/UI:N) implies remote, low-complexity, no-authentication, no-user-interaction access against a WordPress site with PDF Generator for WordPress <= 1.6.2 installed and active. Limiting factors: the site must have the plugin installed and enabled, the vulnerable endpoint must be reachable, and - despite the PR:N rating - WordPress plugin SSRFs of this class are frequently gated behind an authenticated AJAX action, so realistic exploitation may require at least a low-privileged account; the affected endpoint and exact parameter are not detailed in the available data and should be confirmed via the Patchstack advisory. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N scores 7.2 (High), driven largely by the changed scope and network reachability rather than by high per-system impact (confidentiality and integrity are Low, availability None). No EPSS score was provided, there is no POC referenced, and the CVE is not in CISA KEV, so this reads as a real but not urgent priority: exposure exists but there is no evidence of weaponization or mass exploitation. One important caveat - the source vector states PR:N (unauthenticated), yet many WordPress plugin SSRFs of this type are reachable only through an authenticated AJAX/admin action; the description does not confirm which endpoint is affected, so the true privilege requirement should be verified against the Patchstack advisory before treating this as fully unauthenticated. Net: a legitimate SSRF worth patching, especially in cloud-hosted WordPress where IMDS/metadata pivoting raises the real-world impact above the modest Low/Low CIA figures. |
| Exploit ScenarioDerived | An attacker submits a request to the plugin's PDF-generation function containing a URL pointing at an internal target - for example a cloud metadata endpoint (http://169.254.169.254/latest/meta-data/) or an intranet admin panel. The server fetches that URL while rendering the PDF and returns or embeds the response, disclosing internal data or triggering internal state-changing requests. No public POC is referenced, so exploitation would require an attacker to reconstruct the vulnerable endpoint and parameter. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 13, 2026
Server-Side Request Forgery in WP Swings' PDF Generator for WordPress plugin (all versions up to and including 1.6.2) lets remote attackers coerce the WordPress server into issuing attacker-controlled outbound requests, with a scope-changed impact reaching adjacent internal systems. Reported by Patchstack and tracked as CWE-918 with a CVSS 3.1 base score of 7.2, it currently has no public exploit identified at time of analysis and is not listed in CISA KEV. Because the scope is changed (S:C), successful abuse can pivot the server against internal metadata endpoints, intranet services, or cloud IMDS resources beyond the WordPress host itself.
RemediationAI
No vendor-released patch identified at time of analysis - the data lists all versions through 1.6.2 as affected without a confirmed fixed release, so consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/pdf-generator-for-wp/vulnerability/wordpress-pdf-generator-for-wordpress-plugin-1-6-2-server-side-request-forgery-ssrf-vulnerability) and the plugin changelog for an update beyond 1.6.2 and upgrade as soon as one is published. Until then, apply compensating controls: enforce egress filtering so the WordPress host can only reach required external endpoints (blocking outbound access to 169.254.169.254 and RFC1918 ranges neutralizes cloud-metadata and intranet pivoting, at the cost of breaking legitimate internal fetches); place a WAF or virtual-patch rule (Patchstack offers one) in front of the PDF-generation endpoint; and if PDF generation is not essential, deactivate the plugin. Restricting the PDF-generation feature to authenticated, trusted roles reduces the attack surface but does not eliminate SSRF if the endpoint is reachable by low-privileged users.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the PDF Generator for WordPress plugin (CPE cpe:2.3:a:wp_swings:pdf_generator_for_wordpress), which converts WordPress content into downloadable PDFs. PDF-generation plugins routinely fetch remote resources - images, stylesheets, fonts, or user-supplied URLs - during rendering, and CWE-918 (Server-Side Request Forgery) arises when that fetch logic does not validate or restrict the destination, allowing an attacker to substitute an internal or attacker-chosen URL. The root cause class here is missing allowlist/SSRF protection on a server-side HTTP fetch, so the WordPress backend becomes an unwitting proxy. The changed CVSS scope (S:C) reflects that the security-relevant impact falls on systems other than the vulnerable web application - e.g., internal services the WordPress host can reach but an external attacker normally cannot.
Know when Pdf Generator For Wordpress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
SSRF is network-reachable and low-complexity with scope change to internal systems; PR:L reflects that WordPress plugin SSRFs of this type typically require at least authenticated access, diverging from the source PR:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Server-Side Request Forgery (SSRF) vulnerability in WP Swings PDF Generator for WordPress pdf-generator-for-wp allows Server Side Request Forgery.This issue affects PDF Generator for WordPress: from n/a through <= 1.6.2.
Articles & Coverage 1
Executive ViewAI
WP Swings' PDF Generator plugin for WordPress (all versions through 1.6.2) contains a server-side request forgery vulnerability that allows attackers to coerce affected WordPress servers into making attacker-directed requests to internal systems, cloud metadata services, and intranet resources. The scope-changed impact creates significant risk of confidential data exposure and credential compromise through cloud IMDS endpoints. Every WordPress installation using this plugin is exposed without immediate remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) disable the plugin immediately in production if removal cannot be performed within 24 hours; (2) implement network segmentation and firewall rules restricting WordPress server outbound access to only authorized external services; (3) deploy Web Application Firewall rules to block requests from the WordPress application to 169.254.169.254 and internal IP ranges; (4) enable continuous monitoring and alerting on WordPress server outbound connections to detect exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
GitHub PoC
Exploit-DB