Server-Side Request Forgery Vulnerability in Embed PDF Viewer by Andy Fragen
CVE-2026-32349

4.9MEDIUM

Key Information:

Vendor

WordPress
Status
Embed PDF Viewer
Vendor
CVE Published:
13 March 2026

What is CVE-2026-32349?

The Embed PDF Viewer plugin developed by Andy Fragen contains a Server-Side Request Forgery (SSRF) vulnerability that allows unauthorized remote access to internal network resources. This flaw affects all versions up to and including 2.4.7, enabling attackers to manipulate server requests, potentially leading to data breaches and security compromises. Securing your installation against this vulnerability is crucial to maintaining the integrity and confidentiality of your server's data.

Affected Version(s)

Embed PDF Viewer 0 <= 2.4.7

References

https://patchstack.com/database/Wordpress/Plugin/embed-pd...
vdb-entry

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mike Montoya | Patchstack Bug Bounty Program
.