Junglewise Threat Intelligence

CVE-2026-12407: oleksandrz E2Pdf privilege escalation via arbitrary option update

CVE-2026-12407 · Severity: high · CVSS 8.8 · Published 2026-06-18

Executive brief

The E2Pdf plugin for WordPress, which allows users to export documents as PDFs, contains a security flaw that could allow unauthorized users to take control of a website. If a lower-level user (like a contributor or editor) has been granted specific plugin permissions, they can exploit this bug to change critical website settings. This can lead to the attacker elevating their own account to a full administrator, potentially resulting in total site takeover and data theft.

Technical details

The E2Pdf plugin for WordPress is vulnerable to an authorization bypass and arbitrary option update in versions up to 1.32.26. The 'screen_action()' function fails to implement proper capability checks or nonce verification when accessed via the '?action=screen' routing path. An attacker with the 'e2pdf_templates' capability can provide malicious input via the 'wp_screen_options' POST parameter, which is passed directly to the WordPress 'update_option()' function without an allowlist. This allows an authenticated attacker to overwrite arbitrary WordPress database options, such as 'default_role', to achieve full administrative privilege escalation.

Affected products

  • oleksandrz E2Pdf – Export Pdf Tool for WordPress <= 1.32.26

Timeline

  • 2026-06-18: disclosed
  • 2026-06-18: advisory

References