E2Pdf – Export Pdf Tool for WordPress <= 1.32.65 - Authenticated (Contributor+) Path Traversal to Limited File Read and Arbitrary Directory Write via Shortcode 'pdf', 'dpdf' and 'dir' Attributes
- ID
- WPSEC-2026-2967
- Plugin
- E2Pdf – Export Pdf Tool for WordPress (e2pdf)
- Affected
- all versions before 2.00.00
- Remediation
- Update to 2.00.00 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
- Weakness
- CWE-22
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-12
- Attack surface
- E2Pdf – Export Pdf Tool for WordPress on WPSec AttackSurface
- Fix released
- Published
Description
The E2Pdf plugin for WordPress is vulnerable to Path Traversal via the 'pdf', 'dpdf' and 'dir' attributes of the plugin's shortcodes in all versions up to, and including, 1.32.65, due to the file paths not being restricted to allowed folders. This makes it possible for authenticated attackers with contributor-level access and above to read files with pdf, jpg, doc or docx extensions from anywhere on the server, and to write generated PDF files (and a deny-all .htaccess file) to arbitrary writable directories. Version 2.00.00 always applies the new check to shortcodes in non-public posts by users who cannot publish posts; for other content, including posts by authors, it applies only when the 'Access Check' setting is enabled, which is off by default on sites upgraded from earlier versions.
References
- https://wpsec.com/vuln/WPSEC-2026-2967/
- https://plugins.svn.wordpress.org/e2pdf/tags/2.00.00/
- https://wordpress.org/plugins/e2pdf/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS