CVE-2024-31373 MEDIUM

CVE-2024-31373: WordPress E2Pdf plugin <= 1.20.27 - Cross Site Request Forgery (CSRF) vulnerability

Vendor E2Pdf

Product e2pdf

Weakness CWE-352 · CSRF

Published April 15, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

5.4/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in E2Pdf e2pdf e2pdf.This issue affects e2pdf: from n/a through <= 1.20.27.

Explanation of Vulnerability in Simple Terms

02Summary

E2pdf versions up to 1.20.27 are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions within e2pdf without the admin's knowledge or consent. The vulnerability requires user interaction—the admin must visit the attacker's page—but can result in data modification or service disruption.

What an attacker can do

03Attacker Capabilities

Trick a logged-in admin into performing unwanted actions in e2pdf, such as modifying settings or deleting data.

Potential impact on your site

04Site Impact

Administrators could unknowingly authorize malicious changes to e2pdf configuration or data if they visit a compromised or attacker-controlled page.

Conditions required to exploit

05Prerequisites

Admin must visit attacker-controlled webpage while logged into the site.

Key dates

06Disclosure timeline

April 15, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-31373 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/352.html AskarLabs — CWE-352 write-up Cross-Site Request Forgery

Related vulnerabilities