Missing Authorization Vulnerability in E2Pdf Export PDF Tool for WordPress

CVE-2026-12407

What is CVE-2026-12407?

The E2Pdf - Export PDF Tool for WordPress has a vulnerability due to the lack of proper capability checks and nonce verifications in its screen_action() function. This gap allows authenticated users with custom roles who possess the e2pdf_templates capability to bypass security measures and modify critical WordPress options, such as default_role. Consequently, this opens up the potential for privilege escalation, enabling these users to gain administrative rights without appropriate permissions.

References