# E2Pdf – Export Pdf Tool for WordPress <= 2.00.00 - Unauthenticated Shortcode Injection via Form Entry Data

- **ID:** WPSEC-2026-2883
- **Plugin:** E2Pdf – Export Pdf Tool for WordPress (`e2pdf`), https://wordpress.org/plugins/e2pdf/
- **Affected versions:** all versions before 2.00.01
- **Fixed in:** 2.00.01 (Update to 2.00.01 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-94
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/e2pdf
- **Fix released:** 2026-11-11
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2883/

## Description

The E2Pdf plugin for WordPress is vulnerable to shortcode injection via submitted form entry data in all versions up to, and including, 2.00.00, due to entry values (for example Formidable Forms [default-message] output) and [e2pdf-foreach]/[e2pdf-for] loop data being inserted into the PDF template value without neutralizing shortcode syntax before the value is passed to do_shortcode(). This makes it possible for unauthenticated attackers to place E2Pdf data shortcodes such as [e2pdf-user] or [e2pdf-wp] in a form field. These run when the PDF is generated and can expose other users' profile data or user meta, or other posts' data, in a PDF the attacker can download.

## References

- https://wpsec.com/vuln/WPSEC-2026-2883/
- https://plugins.svn.wordpress.org/e2pdf/tags/2.00.01/
- https://wordpress.org/plugins/e2pdf/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2883/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.