PDF.js <= 3.1.1 - Unauthenticated Server-Side Request Forgery via PDF Proxy
- ID
- WPSEC-2026-1686
- Plugin
- PDF.js Viewer (pdfjs-viewer-shortcode)
- Affected
- from 3.1.0 before 3.2.0
- Remediation
- Update to 3.2.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-918
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-27
- Attack surface
- PDF.js on WPSec AttackSurface
- Fix released
- Published
Description
The PDF.js Viewer plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'url' parameter of the PDF proxy (pdfjs/web/pdf-proxy.php) in all versions from 3.1.0 up to, and including, 3.1.1. This is due to insufficient validation of the user-supplied URL. The same-site check compared only the hostname, so a URL on the site's own host but on a different port skipped the domain allow-list. The URL was then fetched with wp_remote_get() instead of wp_safe_remote_get(), and HTTP redirects were followed, so a same-host or allow-listed URL could be redirected to loopback or internal addresses. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and read successful responses, which can be used to query and modify information from internal services.
References
- https://wpsec.com/vuln/WPSEC-2026-1686/
- https://plugins.svn.wordpress.org/pdfjs-viewer-shortcode/tags/3.2.0/
- https://wordpress.org/plugins/pdfjs-viewer-shortcode/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS