# E2Pdf – Export Pdf Tool for WordPress <= 1.32.65 - Authenticated (Contributor+) Path Traversal to Limited File Read and Arbitrary Directory Write via Shortcode 'pdf', 'dpdf' and 'dir' Attributes

- **ID:** WPSEC-2026-2967
- **Plugin:** E2Pdf – Export Pdf Tool for WordPress (`e2pdf`), https://wordpress.org/plugins/e2pdf/
- **Affected versions:** all versions before 2.00.00
- **Fixed in:** 2.00.00 (Update to 2.00.00 or later.)
- **Severity:** High 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N)
- **Weakness:** CWE-22
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/e2pdf
- **Fix released:** 2026-11-10
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2967/

## Description

The E2Pdf plugin for WordPress is vulnerable to Path Traversal via the 'pdf', 'dpdf' and 'dir' attributes of the plugin's shortcodes in all versions up to, and including, 1.32.65, due to the file paths not being restricted to allowed folders. This makes it possible for authenticated attackers with contributor-level access and above to read files with pdf, jpg, doc or docx extensions from anywhere on the server, and to write generated PDF files (and a deny-all .htaccess file) to arbitrary writable directories. Version 2.00.00 always applies the new check to shortcodes in non-public posts by users who cannot publish posts; for other content, including posts by authors, it applies only when the 'Access Check' setting is enabled, which is off by default on sites upgraded from earlier versions.

## References

- https://wpsec.com/vuln/WPSEC-2026-2967/
- https://plugins.svn.wordpress.org/e2pdf/tags/2.00.00/
- https://wordpress.org/plugins/e2pdf/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2967/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.