CVE-2026-12124

Name of the Vulnerable Software and Affected Versions PDFDraft versions prior to 1.1.1

Description Unauthorized access to data is possible due to a missing capability check in the serveTemplatePdfAjax() function and the serveTemplatePdf() REST route, which is registered with permission callback => ' return true'. Unauthenticated attackers can download stored template PDFs containing customer personally identifiable information (PII), invoices, orders, and certificate data. This is achieved by requesting the pdfdraft embed pdf admin-ajax action or the /wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf REST endpoint using a known or guessable slug variable.

Recommendations Update to a version later than 1.1.0. Restrict access to the /wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf REST endpoint and the pdfdraft embed pdf action to minimize the risk of exploitation.