What the vulnerability does
01Description
The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax() function and the serveTemplatePdf() REST route (which is registered with `permission_callback => '__return_true'`) in versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to download stored template PDFs — which may contain customer PII, invoice, order, and certificate data — by requesting the publicly registered admin-ajax action `pdfdraft_embed_pdf` or the REST endpoint `/wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf` with a known or guessable design slug, bypassing the plugin's own .
Explanation of Vulnerability in Simple Terms
02Summary
PDFDraft versions up to 1.1.0 lack proper authorization checks, allowing unauthenticated attackers to read sensitive data through the plugin. An attacker can access information without logging in or performing any special actions. Site administrators should update to a version newer than 1.1.0 to prevent unauthorized data exposure.
What an attacker can do
03Attacker Capabilities
Read sensitive data from the plugin without authentication.
Potential impact on your site
04Site Impact
Unauthorized users can access confidential information stored or processed by PDFDraft.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
July 28, 2026
CVE published
July 28, 2026
Record updated
