CVE-2026-12407
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
The E2Pdf – Export Pdf Tool for WordPress plugin is vulnerable to Missing Authorization in versions up to and including 1.32.26. The screen_action() function lacks a dedicated capability check and nonce verification, allowing attackers to overwrite WordPress options.
Risk Assessment
Authenticated attackers with the appropriate permissions can gain access to WordPress options, potentially escalating their privileges to administrator level. This poses a serious security threat to the entire site.
Recommendation
It is recommended to update the E2Pdf plugin to the latest version to mitigate this vulnerability. Additionally, access to the e2pdf_templates capability should be restricted to trusted roles only.
Related vulnerabilities
- CVE-2026-125757Critical
mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute default value, rendered by the rspamd MOO_FOOTER prefilter, to read or inject mail for every tenant and disable filtering.
- CVE-2026-121683Critical
Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core certificate entries.
- CVE-2026-121653Critical
SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.
- CVE-2026-108186Critical
Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.
- CVE-2026-124917Critical
Sandbox escape vulnerability due to use-after-free in the Widget: Gtk component of Firefox. It may allow bypassing process isolation. The vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
- CVE-2026-124903Critical
A sandbox escape due to a use-after-free exists in the IPC component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.
- CVE-2026-124900Critical
A use-after-free in the DOM: Service Workers component of Firefox allows a sandbox escape. The vulnerability was fixed in Firefox 160.
- CVE-2026-124864Critical
Use-after-free vulnerability in the DOM: Service Workers component of Firefox enabling a sandbox escape. It may allow bypassing browser isolation mechanisms. Fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.
- CVE-2026-124861Critical
Use-after-free vulnerability in the Audio/Video: cubeb component of Firefox enabling a sandbox escape. It may allow bypassing browser isolation mechanisms. Fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.
- CVE-2026-124859Critical
Sandbox escape in the Storage: Cache API component of Firefox caused by incorrect boundary conditions. It may allow bypassing browser isolation mechanisms. Fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.
Original NVD description (English source)
The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.32.26. This is due to the screen_action() function lacking a dedicated capability check and nonce verification — when invoked via the ?action=screen routing path the controller's index_action() nonce gate is bypassed entirely — while reading an attacker-controlled option name and value from $_POST['wp_screen_options'] and passing them directly to update_option() with no allowlist, relying solely on the page-level e2pdf_templates capability which the plugin's own Permissions UI allows administrators to grant to any role including Subscriber, Contributor, Author, or Editor. This makes it possible for authenticated attackers, with a custom role that has been granted the e2pdf_templates capability, to overwrite arbitrary WordPress options such as default_role and thereby escalate their privileges to administrator.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS