CVE-2026-12407 Details
Description
The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.32.26. This is due to the screen_action() function lacking a dedicated capability check and nonce verification — when invoked via the ?action=screen routing path the controller's index_action() nonce gate is bypassed entirely — while reading an attacker-controlled option name and value from $_POST['wp_screen_options'] and passing them directly to update_option() with no allowlist, relying solely on the page-level e2pdf_templates capability which the plugin's own Permissions UI allows administrators to grant to any role including Subscriber, Contributor, Author, or Editor. This makes it possible for authenticated attackers, with a custom role that has been granted the e2pdf_templates capability, to overwrite arbitrary WordPress options such as default_role and thereby escalate their privileges to administrator.
A vulnerability exists in the E2Pdf - Export Pdf Tool for WordPress plugin, specifically in versions through 1.32.26. The issue arises from the screen_action() function, which fails to implement proper capability checks and nonce verification. When the function is called via the ?action=screen routing path, it bypasses the necessary nonce validation. The function reads an option name and value from the $_POST['wp_screen_options'], and directly passes them to update_option() without any allowlist, relying only on the page-level e2pdf_templates capability. This capability can be granted to any role, including Subscriber, Contributor, Author, or Editor, through the plugin's Permissions UI. As a result, authenticated attackers with a custom role that has the e2pdf_templates capability can overwrite arbitrary WordPress options, such as default_role, to escalate their privileges to administrator.
Users are advised to update the E2Pdf - Export Pdf Tool for WordPress plugin to version 1.32.31 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 18, 2026CISA-ADP
Assessed Jun 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| E2Pdf | <= 1.32.26 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 18, 2026 | CVE Modified | CISA-ADP |
| Jun 18, 2026 | New CVE Received | [email protected] |