PDFDraft <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' Parameter
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax() function and the serveTemplatePdf() REST route (which is registered with `permission_callback => '__return_true'`) in versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to download stored template PDFs — which may contain customer PII, invoice, order, and certificate data — by requesting the publicly registered admin-ajax action `pdfdraft_embed_pdf` or the REST endpoint `/wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf` with a known or guessable design slug, bypassing the plugin's own .
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| wpeverest | PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer | up to 1.1.0 | — | No fix listed | CNA |
- PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer Vendorwpeverest Affected up to 1.1.0 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-12124
- 2026-10-03 Alias added: GHSA-vqr6-98r6-wqvg
References
Other 6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3cb869dd-c8cf-4849-a13f-6c8cf1c196b6?source=cve
- https://plugins.trac.wordpress.org/browser/pdfdraft/trunk/src/EmbedPdf.php#L448
- https://plugins.trac.wordpress.org/browser/pdfdraft/trunk/src/EmbedPdf.php#L418
- https://plugins.trac.wordpress.org/browser/pdfdraft/trunk/src/EmbedPdf.php#L60
- https://plugins.trac.wordpress.org/browser/pdfdraft/trunk/src/EmbedPdf.php#L44
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3621033%40pdfdraft&new=3621033%40pdfdraft
More wpeverest vulnerabilities
- TI-2025-00958 Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion CVSS 3.1CRITICAL 9.8
- TI-2026-02850 Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field CVSS 3.1CRITICAL 9.8
- TI-2026-01188 User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration CVSS 3.1CRITICAL 9.8
- TI-2025-02262 User Registration & Membership < 4.1.3 - Authentication Bypass CVSS 3.1HIGH 8.1
- TI-2025-02232 User Registration & Membership < 4.1.2- Unauthenticated Privilege Escalation CVSS 3.1HIGH 8.1
- TI-2022-03588 User Registration < 2.2.4.1 - Subscriber+ Arbitrary File Upload CVSS 3.1HIGH 7.5
Sources
- CVE-2026-12124 · CVE Program
- CVE-2026-12124 · NVD
- FIRST EPSS
- GHSA-vqr6-98r6-wqvg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences