Bui Duy

**Name of the Vulnerable Software and Affected Versions** E2Pdf – Export Pdf Tool for WordPress versions prior to 1.32.27 **Description** The plugin is affected by missing authorization. The `screen action()` function lacks a dedicated capability check and nonce verification. When the `?action=screen` routing path is used, the `index action()` nonce gate is bypassed. The application reads attacker-controlled option names and values from the `wp screen options` parameter in `$ POST` and passes them directly to the `update option()` function without an allowlist. The process relies on the `e2pdf templates` capability, which administrators can grant to roles such as Subscriber, Contributor, Author, or Editor. This allows authenticated attackers with the `e2pdf templates` capability to overwrite arbitrary WordPress options, such as `default role`, to escalate privileges to administrator. **Recommendations** Update the plugin to a version later than 1.32.26.