What is the CVSS score of EUVD-2026-53913?

EUVD-2026-53913 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of e2pdf WordPress Plugin are affected by EUVD-2026-53913?

The e2pdf WordPress plugin (versions ≤1.32.40) contains a remote file inclusion vulnerability allowing unauthenticated attackers to access arbitrary server files.

How to fix or mitigate EUVD-2026-53913?

Within 24 hours, identify and disable the e2pdf plugin on all WordPress installations running versions 1.32.40 or earlier to prevent exploitation. Within 7 days, completely remove the plugin and conduct a comprehensive review of access logs to identify any unauthorized file access attempts during the exposure period. Within 30 days, monitor official vendor channels for patch releases and establish a testing and deployment process to apply updates immediately upon availability, while evaluating alternative file processing solutions as a contingency.

e2pdf WordPress Plugin EUVD-2026-53913

| CVE-2026-66710 HIGH

PHP Remote File Inclusion (CWE-98)

2026-08-06 Patchstack

GHSA-9gm8-vrm2-9p9r

PHP WordPress Information Disclosure LFI E2pdf Wordpress Plugin

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network vector and no auth confirmed by description; AC:H reflects LFI-to-RCE requiring secondary file-plant precondition; C/I/A:H for worst-case PHP execution impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:36 vuln.today

CVE Published

Aug 06, 2026 - 14:28 cve.org

HIGH 8.1

DescriptionCVE.org

Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions.

AnalysisAI

Local File Inclusion in the e2pdf WordPress plugin (versions up to and including 1.32.40) enables unauthenticated remote attackers to include arbitrary PHP files from the server filesystem, potentially yielding full confidentiality, integrity, and availability compromise. Reported by Patchstack and registered under ENISA EUVD-2026-53913, the flaw stems from CWE-98 (PHP file inclusion without proper input sanitization). No public exploit code or CISA KEV entry has been identified at time of analysis, but the network-accessible, zero-authentication attack path makes patching a priority for any WordPress operator running this plugin.

Technical ContextAI

CWE-98 - 'Improper Control of Filename for Include/Require Statement in PHP Program' - is a PHP-specific subclass of path traversal where user-controlled input reaches a PHP include() or require() call without adequate sanitization or allowlist enforcement. The affected product, identified by CPE cpe:2.3:a:e2pdf:e2pdf:*:*:*:*:*:*:*:*, is a WordPress plugin used for generating and managing PDF documents from WordPress data. Because WordPress plugins run in the PHP application context with access to the full server filesystem, an exploitable include path can expose sensitive configuration files (e.g., wp-config.php), application secrets, or, under the right conditions, enable remote code execution through log poisoning or upload-based file planting. The AC:H CVSS metric indicates that additional specific preconditions - likely related to the attacker's ability to influence or place file content on the server - must be met for full exploitation, distinguishing this from a trivially weaponizable network flaw.

RemediationAI

Update the e2pdf plugin to a version above 1.32.40 as soon as a patched release is available from the plugin author. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/e2pdf/vulnerability/wordpress-e2pdf-plugin-1-32-40-local-file-inclusion-vulnerability should be monitored for the confirmed fixed version number, which was not independently verifiable from the available intelligence at time of analysis. If an immediate update is not possible, restrict access to the WordPress plugin's PDF generation endpoints via WAF rules blocking path traversal patterns (e.g., '../', absolute path sequences in parameters), or temporarily disable the e2pdf plugin until a patch is applied - noting that disabling will halt PDF generation functionality. Additionally, if the site permits file uploads, review and restrict upload directories to non-executable paths to reduce the LFI-to-RCE escalation surface.