PDFDraft <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' Parameter
Strategic Overview
- Status
- Patched in 1.1.1
- Affected Plugin
- PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer
- Affected Version
<= 1.1.0- CVSS
- 5.3Medium
- Weakness type
- CWE-862 · Missing Authorization
- CVE
CVE-2026-12124
At a glance
CVE-2026-12124 is a medium-severity Missing Authorization vulnerability in the PDFDraft WordPress plugin, affecting versions <= 1.1.0. It carries a CVSS score of 5.3 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 1.1.1; sites on affected versions should update now. Disclosed July 2026, reported by sl4x0.
Vulnerability Overview
The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax() function and the serveTemplatePdf() REST route (which is registered with `permission_callback => '__return_true'`) in versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to download stored template PDFs — which may contain customer PII, invoice, order, and certificate data — by requesting the publicly registered admin-ajax action `pdfdraft_embed_pdf` or the REST endpoint `/wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf` with a known or guessable design slug, bypassing the plugin's own .
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.
CWE-862: Missing Authorization
PDFDraft <= 1.1.0 carries this weakness at __return_true, and reaching it takes no account at all. A missing authorization check means a function is reachable by anyone who can reach the endpoint, because the code never asks whether the caller is allowed to perform the action.
Any user who can reach the endpoint gets to run an action reserved for higher-privileged roles, from reading protected data to changing settings or content. For PDFDraft the fix is 1.1.1: builds <= 1.1.0 are affected, anything from 1.1.1 onward is not.
Remediation
Update to version 1.1.1, or a newer patched version
How does WordSec protect against this?
This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: PDFDraft 1.1.1 closes this, and updating the plugin is the step that ends it.
- Login Security
- Alerts
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C