{
 "id": "WPSEC-2026-2968",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2968/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2968/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2968/index.md",
 "title": "E2Pdf – Export Pdf Tool for WordPress <= 1.32.65 - Authenticated (Contributor+) Insecure Direct Object Reference via Shortcode Attributes",
 "description": "The E2Pdf plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'dataset', 'dataset2', 'user_id', 'wc_order_id' and 'attachment_id' attributes of the e2pdf-download, e2pdf-view, e2pdf-attachment, e2pdf-save and e2pdf-zapier shortcodes in all versions up to, and including, 1.32.65, due to missing validation that the current user (or the author of the post containing the shortcode) may access the referenced record. This makes it possible for authenticated attackers with contributor-level access and above to generate and download PDFs filled with other users' form entries, orders, user data or private media files. Version 2.00.00 always applies the new check to shortcodes in non-public posts by users who cannot publish posts; for other content, including posts by authors, it applies only when the 'Access Check' setting is enabled, which is off by default on sites upgraded from earlier versions.",
 "plugin": {
  "slug": "e2pdf",
  "name": "E2Pdf – Export Pdf Tool for WordPress",
  "full_name": "E2Pdf – Export Pdf Tool for WordPress",
  "wordpress_org": "https://wordpress.org/plugins/e2pdf/",
  "advisories_url": "https://wpsec.com/vuln/plugin/e2pdf/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/e2pdf"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.00.00",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.00.00"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.00.00",
 "remediation": "Update to 2.00.00 or later.",
 "fix_released": "2026-11-10T14:05:56+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:13:57.017432+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2968/",
  "https://plugins.svn.wordpress.org/e2pdf/tags/2.00.00/",
  "https://wordpress.org/plugins/e2pdf/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/e2pdf",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-12"
 }
}