EUVD-2026-49689
GHSA-vqr6-98r6-wqvg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessProbe for plugin presence
-
DeliveryGuess or discover design slug
-
ExploitSend GET request to REST endpoint
-
ExecutionReceive PDF with sensitive data
-
ImpactExtract customer PII or invoices
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker does not require any privileged access or user interaction. The specific condition for exploitation is knowledge of a valid design slug for a template. While the plugin does not expose a list of slugs by default, they may be guessable based on common naming patterns or leaked in other parts of the site (e.g., shortcodes, logs). The REST endpoint and admin-ajax action are publicly accessible without authentication, fulfilling the AV:N/AC:L/PR:N/UI:N vector. Limiting factors: the attacker must discover or guess a valid slug; if no sensitive data is stored in template PDFs, the impact is negligible. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates a network-accessible, low-complexity, unauthenticated attack with no user interaction, but only low confidentiality impact. No EPSS score, CISA KEV status, or public proof-of-concept have been provided, so the real-world exploitation likelihood is unknown. The vulnerability is real and easily exploitable if attackers can guess or enumerate design slugs, but the impact is limited to reading stored PDF data. Given the lack of active exploitation signals and the medium CVSS score, this is a moderate priority that should be addressed through patching, but it does not warrant immediate emergency response unless sensitive data is stored in these templates. |
| Exploit ScenarioDerived | An attacker scans WordPress websites for the PDFDraft plugin, then enumerates common or guessable design slugs (e.g., 'invoice', 'certificate', 'default') by sending GET requests to |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 28, 2026
Unauthorized data access in the PDFDraft WordPress plugin allows unauthenticated attackers to download stored template PDFs containing customer PII, invoices, orders, and certificates. This is due to a missing capability check in the serveTemplatePdfAjax() function and the REST route registered with __return_true, affecting versions up to and including 1.1.0. No public exploit or active exploitation has been identified at the time of analysis, and the CVSS base score of 5.3 reflects the moderate but easily exploitable nature of the issue.
RemediationAI
The primary fix is to upgrade the PDFDraft plugin to version 1.1.1 or later, as evidenced by the Trac changeset that adds capability checks to the affected functions. Users should update via the WordPress admin dashboard or by downloading the latest version from the WordPress plugin repository. If immediate patching is not possible, as a workaround, administrators can restrict access to the REST endpoint /wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf by adding an IP whitelist or a custom authentication check via a WordPress mu-plugin, but this may break legitimate functionality. Additionally, reviewing and removing any sensitive data from template PDF files would reduce exposure; however, this does not address the underlying vulnerability. Side effects of the workaround include potential denial of service for legitimate users and added maintenance overhead.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in WordPress plugin 'PDFDraft - Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer' (CPE: cpe:2.3:a:wpeverest:pdfdraft_-_drag_&_drop_pdf_builder,_pdf_viewer,_embed_&_download_pdf,_certificate_&_invoice_designer:*:*:*:*:*:*:*:*). The plugin uses WordPress AJAX actions and REST API endpoints to serve template PDFs. The function serveTemplatePdfAjax() (hooked to admin-ajax action pdfdraft_embed_pdf) and the REST route /wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf lack proper capability checks, with the REST route explicitly using permission_callback => '__return_true' to allow unauthenticated access. This is a classic CWE-862 Missing Authorization flaw where the application fails to enforce access control before serving sensitive data.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
No authentication or user interaction, network accessible, low complexity, only low confidentiality impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The PDFDraft - Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax() function and the serveTemplatePdf() REST route (which is registered with permission_callback => '__return_true') in versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to download stored template PDFs - which may contain customer PII, invoice, order, and certificate data - by requesting the publicly registered admin-ajax action pdfdraft_embed_pdf or the REST endpoint /wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf with a known or guessable design slug, bypassing the plugin's own .
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB