E2Pdf – Export Pdf Tool for WordPress <= 1.32.65 - Authenticated (Contributor+) Insecure Direct Object Reference via Shortcode Attributes
- ID
- WPSEC-2026-2968
- Plugin
- E2Pdf – Export Pdf Tool for WordPress (e2pdf)
- Affected
- all versions before 2.00.00
- Remediation
- Update to 2.00.00 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-12
- Attack surface
- E2Pdf – Export Pdf Tool for WordPress on WPSec AttackSurface
- Fix released
- Published
Description
The E2Pdf plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'dataset', 'dataset2', 'user_id', 'wc_order_id' and 'attachment_id' attributes of the e2pdf-download, e2pdf-view, e2pdf-attachment, e2pdf-save and e2pdf-zapier shortcodes in all versions up to, and including, 1.32.65, due to missing validation that the current user (or the author of the post containing the shortcode) may access the referenced record. This makes it possible for authenticated attackers with contributor-level access and above to generate and download PDFs filled with other users' form entries, orders, user data or private media files. Version 2.00.00 always applies the new check to shortcodes in non-public posts by users who cannot publish posts; for other content, including posts by authors, it applies only when the 'Access Check' setting is enabled, which is off by default on sites upgraded from earlier versions.
References
- https://wpsec.com/vuln/WPSEC-2026-2968/
- https://plugins.svn.wordpress.org/e2pdf/tags/2.00.00/
- https://wordpress.org/plugins/e2pdf/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS