CVE-2026-12124: PDFDraft WordPress Auth Bypass Flaw

CVE-2026-12124 Overview

CVE-2026-12124 is a missing authorization vulnerability [CWE-862] in the PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress. The flaw affects versions up to and including 1.1.0. The serveTemplatePdfAjax() function and the serveTemplatePdf() REST route lack capability checks. The REST route is registered with permission_callback => '__return_true', exposing it to unauthenticated callers. Attackers can download stored template PDFs — including customer PII, invoices, orders, and certificates — by requesting the pdfdraft_embed_pdf admin-ajax action or the /wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf endpoint with a known or guessable design slug.

Critical Impact
Unauthenticated remote attackers can retrieve stored PDF templates that may contain personally identifiable information, invoice, order, and certificate data.

Affected Products

PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress
All versions up to and including 1.1.0
WordPress installations exposing the pdfdraft_embed_pdf admin-ajax action or the /wp-json/pdfdraft/v1/embed-pdf/ REST namespace

Discovery Timeline

2026-07-28 - CVE-2026-12124 published to the National Vulnerability Database (NVD)
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-12124

Vulnerability Analysis

The PDFDraft plugin exposes two distinct paths to serve stored template PDFs: an admin-ajax handler and a REST route. Both paths omit authorization enforcement. The AJAX handler serveTemplatePdfAjax() is registered against the pdfdraft_embed_pdf action without gating on current_user_can() or any capability. The REST route registers with permission_callback => '__return_true', which unconditionally accepts every caller. An unauthenticated attacker who supplies a known or guessable design slug receives the corresponding PDF file. Because these templates are used for invoices, certificates, and order documents, disclosed content may contain personally identifiable information (PII), transactional data, and internal document identifiers.

Root Cause

The root cause is a missing capability check [CWE-862] on server-side entry points that serve privileged content. The developer registered the REST endpoint with a permanent-allow permission callback (__return_true) and did not add a capability check inside the AJAX handler. The plugin's internal access logic that gates the front-end is not enforced at the server transport layer.

Attack Vector

Exploitation requires only network access to the target WordPress site. No authentication, no privileges, and no user interaction are required. An attacker enumerates or guesses slug values used as template identifiers and issues an HTTP GET to /wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf or a request to wp-admin/admin-ajax.php with action=pdfdraft_embed_pdf. The server returns the raw stored PDF. Slug enumeration is often trivial when slugs are sequential, human-readable, or exposed via page source and sitemaps. Refer to the Wordfence Vulnerability Analysis and the WordPress PDFDraft source for the vulnerable code paths.

Detection Methods for CVE-2026-12124

Indicators of Compromise

Unauthenticated HTTP GET requests to /wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf from external source addresses.
Requests to /wp-admin/admin-ajax.php with action=pdfdraft_embed_pdf originating from unauthenticated sessions.
Sequential or dictionary-style enumeration of slug parameters producing HTTP 200 responses with Content-Type: application/pdf.
Elevated outbound bandwidth from the WordPress server to a single external IP correlated with PDF response payloads.

Detection Strategies

Alert on any request to the pdfdraft REST namespace that lacks a valid wordpress_logged_in_* cookie.
Correlate admin-ajax.php calls carrying action=pdfdraft_embed_pdf against session state to surface unauthenticated retrievals.
Track response-code and byte-size patterns across {slug} values to detect brute-force enumeration.

Monitoring Recommendations

Ingest WordPress access logs into a centralized analytics platform such as Singularity Data Lake and query for the vulnerable endpoint paths across historical data.
Enable web application firewall (WAF) logging for the /wp-json/pdfdraft/ prefix and retain payload metadata for 90 days.
Build a dashboard tracking counts of 200 responses for the pdfdraft_embed_pdf action grouped by source IP.

How to Mitigate CVE-2026-12124

Immediate Actions Required

Upgrade the PDFDraft plugin to a version later than 1.1.0 that includes the fix from the PDFDraft changeset.
If a patched release is not yet deployed, deactivate the PDFDraft plugin on production sites that store sensitive customer data.
Rotate any template slugs that may have been indexed or exposed, and review server access logs for prior unauthenticated retrievals.
Audit stored templates and remove PII, payment metadata, or certificate data that is not required.

Patch Information

The vendor addressed the vulnerability in the plugin repository. The upstream commit is tracked as changeset 3621033 in the WordPress plugin trac. The fix adds capability enforcement to serveTemplatePdfAjax() and replaces the permissive permission_callback => '__return_true' on serveTemplatePdf() with a capability-aware callback. Site owners should apply the update through the WordPress plugin auto-update mechanism.

Workarounds

Block external access to /wp-json/pdfdraft/ and admin-ajax.php?action=pdfdraft_embed_pdf at the WAF or reverse proxy until a patched version is installed.
Restrict REST API access to authenticated users by adding a global rest_authentication_errors filter that rejects anonymous requests to the pdfdraft/v1 namespace.
Move stored PDF templates off the public web root and serve them only through a hardened handler with capability checks.

bash

# Example nginx block to deny unauthenticated access to the vulnerable endpoints
location ~ ^/wp-json/pdfdraft/ {
    deny all;
    return 403;
}

location = /wp-admin/admin-ajax.php {
    if ($arg_action = "pdfdraft_embed_pdf") {
        return 403;
    }
}