Save as PDF EUVD-2026-83481

Requires the Save as PDF Plugin by PDFCrowd (<=4.6.1) installed and active on WordPress, plus an authenticated account with Contributor-level capability or higher to author the shortcode and cause the server to encrypt the attacker-supplied pdf_created_callback into a valid button blob. No non-default configuration or special feature toggle is needed - the vulnerable eval_shortcode()/create_button() path and the unauthenticated wp_ajax_nopriv_save_as_pdf_pdfcrowd trigger are present by default. The limiting factor is the Contributor+ authentication needed to mint the blob (the trigger replay itself is unauthenticated); the invoked callback receives only the plugin's options array as its single argument, so impact is bounded to functions abusable with that fixed input (notably API-key disclosure) rather than fully arbitrary code with attacker-controlled arguments.

CVSS 3.1 rates this 8.8 High (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the flaw is a genuine CWE-94 code-injection: a Contributor-level user can get the server to mint a cryptographically valid AES blob whose embedded pdf_created_callback is invoked as a PHP callable at line 1722 with no is_callable(), allowlist, or capability guard. The blob is then triggerable by any unauthenticated visitor via wp_ajax_nopriv_save_as_pdf_pdfcrowd, so PR:L (the blob-crafting step) is the true gating privilege. No EPSS score, no CISA KEV listing, and no public exploit are present in the input - exploitation status is 'no public exploit identified at time of analysis' - so this is a real patch-priority code-injection but not evidence of active exploitation. One material caveat lowers the raw score's real-world impact: the invoked function receives the plugin's own options array as its SOLE argument (the attacker chooses the function NAME, not arbitrary arguments), so the clearly-demonstrated impact is disclosure of the stored PDFCrowd API key/username (C:H) while the vendor's I:H/A:H are more speculative 'further server-side abuse' than confirmed. Treat as a high-priority fix on affected sites that allow untrusted Contributor accounts; low priority where all authors are trusted.

An attacker registers or compromises a WordPress Contributor account, authors a draft/post containing the plugin's shortcode with a malicious pdf_created_callback attribute, and the server AES-encrypts that callback into a valid button blob during rendering. The attacker (or any anonymous visitor) then replays the blob to the unauthenticated wp_ajax_nopriv_save_as_pdf_pdfcrowd endpoint, causing the plugin to invoke the attacker-named PHP function with the plugin option data - exfiltrating the stored PDFCrowd API key and username. No public exploit code is identified at time of analysis.