CVE-2026-12407

Name of the Vulnerable Software and Affected Versions E2Pdf – Export Pdf Tool for WordPress versions prior to 1.32.27

Description The plugin is affected by missing authorization. The screen action() function lacks a dedicated capability check and nonce verification. When the ?action=screen routing path is used, the index action() nonce gate is bypassed. The application reads attacker-controlled option names and values from the wp screen options parameter in $ POST and passes them directly to the update option() function without an allowlist. The process relies on the e2pdf templates capability, which administrators can grant to roles such as Subscriber, Contributor, Author, or Editor. This allows authenticated attackers with the e2pdf templates capability to overwrite arbitrary WordPress options, such as default role, to escalate privileges to administrator.

Recommendations Update the plugin to a version later than 1.32.26.