Unauthorized Data Access in PDFDraft Plugin for WordPress
CVE-2026-12124

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
PDFdraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer
Vendor
CVE Published:
28 July 2026

What is CVE-2026-12124?

The PDFDraft plugin for WordPress has a security flaw that enables unauthorized access to sensitive user data. Due to a lack of appropriate capability checks on specific functions, unauthenticated attackers can exploit this vulnerability to download template PDFs that may include personally identifiable information (PII), invoices, and other sensitive content. By triggering the publicly available admin-ajax action or accessing known REST endpoints, attackers can easily extract data without any authentication, putting users' information at significant risk.

Affected Version(s)

PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer 0 <= 1.1.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/pdfdraft/trunk...
https://plugins.trac.wordpress.org/browser/pdfdraft/trunk...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

sl4x0
.