Save As Pdf Plugin By Pdfcrowd
Monthly
Arbitrary PHP function invocation in the Save as PDF Plugin by PDFCrowd for WordPress (all versions up to and including 4.6.1) allows any authenticated user with Contributor-level access or higher to have the server AES-encrypt an attacker-chosen pdf_created_callback value into a valid button blob, which is later passed to PHP as a callable when any unauthenticated visitor POSTs that blob to the wp_ajax_nopriv_save_as_pdf_pdfcrowd AJAX endpoint. Published CVSS 3.1 is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); our assessment retains the High rating but bounds the impact to C:H/I:L/A:L because the invoked callback receives only the plugin's options array as its single, fixed argument, making disclosure of the site's stored PDFCrowd API key and username the most reliable outcome rather than fully attacker-controlled code execution. Contributors are required only to mint the blob - the trigger replay is unauthenticated - and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status.
Arbitrary PHP function invocation in the Save as PDF Plugin by PDFCrowd for WordPress (all versions up to and including 4.6.1) allows any authenticated user with Contributor-level access or higher to have the server AES-encrypt an attacker-chosen pdf_created_callback value into a valid button blob, which is later passed to PHP as a callable when any unauthenticated visitor POSTs that blob to the wp_ajax_nopriv_save_as_pdf_pdfcrowd AJAX endpoint. Published CVSS 3.1 is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); our assessment retains the High rating but bounds the impact to C:H/I:L/A:L because the invoked callback receives only the plugin's options array as its single, fixed argument, making disclosure of the site's stored PDFCrowd API key and username the most reliable outcome rather than fully attacker-controlled code execution. Contributors are required only to mint the blob - the trigger replay is unauthenticated - and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status.