Executive brief
A vulnerability in the PDFDraft plugin for WordPress allows unauthorized individuals to access and download stored PDF documents. This plugin is used to create and manage documents like invoices, certificates, and order forms. An attacker could exploit this flaw to obtain sensitive customer information, including personally identifiable information (PII) and financial records, without needing to log in.
Technical details
The PDFDraft plugin for WordPress (versions up to 1.1.0) contains a missing authorization vulnerability (CWE-862) within the serveTemplatePdfAjax() function and the serveTemplatePdf() REST route. The REST route is improperly configured with 'permission_callback => __return_true', effectively disabling access control. An unauthenticated attacker can exploit this by sending requests to the 'pdfdraft_embed_pdf' admin-ajax action or the '/wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf' REST endpoint. By providing a known or guessable design slug, the attacker can bypass intended security restrictions to download PDF templates that may contain sensitive PII, invoices, and certificates.
Affected products
- wpeverest PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer up to, and including, 1.1.0
Timeline
- 2026-07-28: advisory: NVD publication date
References
- https://plugins.trac.wordpress.org/browser/pdfdraft/trunk/src/EmbedPdf.php
- https://plugins.trac.wordpress.org/browser/pdfdraft/trunk/src/EmbedPdf.php
- https://plugins.trac.wordpress.org/browser/pdfdraft/trunk/src/EmbedPdf.php
- https://plugins.trac.wordpress.org/browser/pdfdraft/trunk/src/EmbedPdf.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3621033%40pdfdraft&new=3621033%40pdfdraft
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3cb869dd-c8cf-4849-a13f-6c8cf1c196b6?source=cve