CVE-2026-92807

Received Received - Intake

Arbitrary Function Invocation in Save as PDF Plugin by PDFCrowd

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and including, 4.6.1 via the `pdf_created_callback` shortcode attribute. The `eval_shortcode()` function copies any non-`button_`/non-`email_` shortcode attribute verbatim into a custom options array without sanitization, allowlist enforcement, or capability checks, and `create_button()` AES-encrypts that array — including the attacker-supplied callback value — and embeds the resulting blob in the rendered button HTML; when the blob is later POSTed to the unauthenticated `wp_ajax_nopriv_save_as_pdf_pdfcrowd` endpoint, `save_as_pdf_pdfcrowd()` decrypts it and invokes `$options['pdf_created_callback']` as a PHP callable at line 1722 with no `is_callable()` guard, no allowlist, and no capability check. This makes it possible for authenticated attackers, with Contributor-level access and above, to invoke arbitrary PHP functions or static class methods with plugin option data as the sole argument, enabling disclosure of the site's stored PDFCrowd API key and username or further server-side abuse. Note that the encryption boundary does not mitigate this vector because the server itself encrypts the attacker-chosen callback during shortcode rendering, supplying any authenticated Contributor with a cryptographically valid blob that any unauthenticated visitor can subsequently replay to trigger invocation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-92807

Affected Vendors & Products

Vendor	Product	Version / Range
pdfcrowd	save_as_pdf_plugin	to 4.6.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability allows authenticated attackers with Contributor-level access or higher to execute arbitrary PHP functions via a shortcode in the Save as PDF Plugin by PDFCrowd for WordPress. The plugin fails to sanitize or validate the pdf_created_callback attribute, enabling attackers to inject malicious code that gets encrypted and later decrypted and executed when a specific endpoint is accessed.

Detection Guidance

Check WordPress sites using the Save as PDF Plugin by PDFCrowd for versions up to 4.6.1. Inspect shortcode attributes for `pdf_created_callback` usage. Review server logs for POST requests to `wp_ajax_nopriv_save_as_pdf_pdfcrowd` with encrypted payloads. Look for unauthorized PHP function invocations in logs.

Impact Analysis

An attacker could exploit this to disclose sensitive data like the site's PDFCrowd API key and username. They could also perform further server-side actions, potentially leading to full system compromise depending on the privileges of the invoked functions.

Compliance Impact

This vulnerability could lead to unauthorized access and disclosure of sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using this plugin may face compliance violations and potential legal consequences.

Mitigation Strategies

Immediately update the Save as PDF Plugin by PDFCrowd to the latest version beyond 4.6.1. If an update is unavailable, consider disabling or removing the plugin entirely. Review user roles with Contributor-level access or higher and restrict unnecessary permissions.

Hi! I’m here to help you understand CVE-2026-92807. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70