E2Pdf – Export Pdf Tool for WordPress <= 2.00.00 - Unauthenticated Shortcode Injection via Form Entry Data
- ID
- WPSEC-2026-2883
- Plugin
- E2Pdf – Export Pdf Tool for WordPress (e2pdf)
- Affected
- all versions before 2.00.01
- Remediation
- Update to 2.00.01 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-94
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-12
- Attack surface
- E2Pdf – Export Pdf Tool for WordPress on WPSec AttackSurface
- Fix released
- Published
Description
The E2Pdf plugin for WordPress is vulnerable to shortcode injection via submitted form entry data in all versions up to, and including, 2.00.00, due to entry values (for example Formidable Forms [default-message] output) and [e2pdf-foreach]/[e2pdf-for] loop data being inserted into the PDF template value without neutralizing shortcode syntax before the value is passed to do_shortcode(). This makes it possible for unauthenticated attackers to place E2Pdf data shortcodes such as [e2pdf-user] or [e2pdf-wp] in a form field. These run when the PDF is generated and can expose other users' profile data or user meta, or other posts' data, in a PDF the attacker can download.
References
- https://wpsec.com/vuln/WPSEC-2026-2883/
- https://plugins.svn.wordpress.org/e2pdf/tags/2.00.01/
- https://wordpress.org/plugins/e2pdf/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS