CVE-2026-12124
Received Received - Intake

Unauthenticated PDF Download in PDFDraft WordPress Plugin

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: Wordfence

Description
The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax() function and the serveTemplatePdf() REST route (which is registered with `permission_callback => '__return_true'`) in versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to download stored template PDFs — which may contain customer PII, invoice, order, and certificate data — by requesting the publicly registered admin-ajax action `pdfdraft_embed_pdf` or the REST endpoint `/wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf` with a known or guessable design slug, bypassing the plugin's own .

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-12124
EUVD
EUVD-2026-49689

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pdfdraft pdfdraft to 1.1.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the PDFDraft WordPress plugin up to version 1.1.0. It allows unauthenticated attackers to download stored template PDFs containing sensitive data like customer PII, invoices, orders, or certificates by exploiting missing capability checks in the serveTemplatePdfAjax() function and a publicly accessible REST route with no proper permission restrictions.

Detection Guidance

Check for unauthorized access to the plugin's REST endpoints or admin-ajax actions. Monitor logs for requests to /wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf or the admin-ajax action pdfdraft_embed_pdf with known slugs. Use tools like curl to test if these endpoints return PDF data without authentication.

Impact Analysis

Unauthenticated attackers can access and download sensitive PDFs containing personal or business data. This could lead to data breaches, exposure of confidential information, or misuse of customer details. The impact depends on the type of data stored in the PDFs.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without authorization and HIPAA by leaking protected health information if stored in PDFs. Organizations may face fines or legal consequences for failing to protect sensitive data.

Mitigation Strategies

Update the PDFDraft plugin to the latest version if available. If no update exists, disable the plugin immediately. Restrict access to the vulnerable endpoints via web server rules or firewall. Review stored PDFs for potential data exposure and notify affected users if necessary.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12124. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart