Executive Summary

The E2Pdf – Export Pdf Tool for WordPress plugin is vulnerable to Missing Authorization in versions up to and including 1.32.26. This vulnerability arises because the screen_action() function does not perform a dedicated capability check or nonce verification. When accessed via the ?action=screen routing path, it bypasses the usual nonce check in index_action(). The function reads an attacker-controlled option name and value from the POST parameter 'wp_screen_options' and passes them directly to update_option() without any allowlist. The plugin relies only on the e2pdf_templates capability, which administrators can grant to any role, including low-privilege roles like Subscriber, Contributor, Author, or Editor. This allows an authenticated attacker with a custom role granted this capability to overwrite arbitrary WordPress options, such as default_role, enabling privilege escalation to administrator.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an authenticated attacker with a custom role that has been granted the e2pdf_templates capability to overwrite arbitrary WordPress options. For example, they could change the default_role option to escalate their privileges to administrator. This leads to a full compromise of the WordPress site, including the ability to modify content, install malicious plugins or themes, and access sensitive data.

Useful 0 Not Useful 0