Sl4X0

**Name of the Vulnerable Software and Affected Versions** PDFDraft versions prior to 1.1.1 **Description** Unauthorized access to data is possible due to a missing capability check in the `serveTemplatePdfAjax()` function and the `serveTemplatePdf()` REST route, which is registered with `permission callback => ' return true'`. Unauthenticated attackers can download stored template PDFs containing customer personally identifiable information (PII), invoices, orders, and certificate data. This is achieved by requesting the `pdfdraft embed pdf` admin-ajax action or the `/wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf` REST endpoint using a known or guessable `slug` variable. **Recommendations** Update to a version later than 1.1.0. Restrict access to the `/wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf` REST endpoint and the `pdfdraft embed pdf` action to minimize the risk of exploitation.