CVE-2026-92807: WordPress Save as PDF Plugin RCE Vulnerability

CVE-2026-92807 Overview

CVE-2026-92807 affects the Save as PDF Plugin by PDFCrowd for WordPress in all versions up to and including 4.6.1. The plugin exposes an arbitrary function invocation flaw [CWE-94] through the pdf_created_callback shortcode attribute. Authenticated attackers with Contributor-level access can supply an arbitrary PHP callable that the plugin later invokes through the unauthenticated wp_ajax_nopriv_save_as_pdf_pdfcrowd endpoint. Successful exploitation can disclose the site's stored PDFCrowd API key and username, or lead to further server-side abuse depending on which callable the attacker selects.

Critical Impact

A Contributor account can plant an encrypted payload that any unauthenticated visitor can replay to execute arbitrary PHP functions on the WordPress server.

Affected Products

• Save as PDF Plugin by PDFCrowd for WordPress, versions up to and including 4.6.1
• WordPress sites permitting Contributor-level accounts to use the plugin's shortcode
• Any site that renders the plugin's button HTML to unauthenticated visitors

Discovery Timeline

• 2026-09-19 - CVE-2026-92807 published to the National Vulnerability Database
• 2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-92807

Vulnerability Analysis

The flaw resides in how the plugin processes shortcode attributes and later dispatches an AJAX callback. The eval_shortcode() function copies any non-button_ and non-email_ shortcode attribute verbatim into a custom options array. This copy occurs without sanitization, allowlist enforcement, or capability checks. The create_button() routine then AES-encrypts that array, including the attacker-supplied pdf_created_callback value, and embeds the resulting blob in the rendered button HTML.

When a visitor POSTs the blob to the unauthenticated wp_ajax_nopriv_save_as_pdf_pdfcrowd endpoint, save_as_pdf_pdfcrowd() decrypts it and invokes $options['pdf_created_callback'] as a PHP callable at line 1722. The invocation passes plugin option data as the sole argument, which enables disclosure of the stored PDFCrowd API key and username when a reflective callable such as print_r or var_export is used.

Root Cause

The callable at line 1722 executes with no is_callable() guard, no allowlist of permitted functions, and no capability check on the caller. Combined with the shortcode handler's failure to filter attribute names, this allows any Contributor to smuggle a callable name into the encrypted options blob.

Attack Vector

The encryption boundary does not mitigate the vector because the server itself encrypts the attacker-chosen callback during shortcode rendering. A Contributor submits a post or page containing the plugin's shortcode with a crafted pdf_created_callback attribute. The server returns a cryptographically valid blob embedded in the button HTML. Any unauthenticated visitor can then replay that blob to wp_ajax_nopriv_save_as_pdf_pdfcrowd to trigger invocation of the attacker-chosen PHP function or static class method. See the Wordfence Vulnerability Report and the referenced plugin source at line 1722 for the vulnerable code path.

Detection Methods for CVE-2026-92807

Indicators of Compromise

• POST requests to /wp-admin/admin-ajax.php with action=save_as_pdf_pdfcrowd originating from unauthenticated sessions in unexpected volumes.
• Post or page revisions authored by Contributor accounts that contain the plugin's shortcode with unusual attributes such as pdf_created_callback.
• Application logs showing execution of introspection functions (for example, print_r, var_export, get_option) immediately following AJAX calls to the plugin endpoint.
• Outbound traffic or log entries indicating exposure of the stored PDFCrowd API key or username.

Detection Strategies

• Audit wp_posts for content containing [save_as_pdf_pdfcrowd shortcodes that include the pdf_created_callback attribute.
• Inspect web server logs for admin-ajax.php calls with the plugin's action parameter and correlate against authenticated session data.
• Use file integrity monitoring on class-save-as-pdf-pdfcrowd-public.php to identify tampering or downgrade attempts.

Monitoring Recommendations

• Alert on new Contributor-level post creation followed within a short window by unauthenticated hits to the plugin's AJAX endpoint.
• Track responses from admin-ajax.php that contain unusual serialized PHP output or option data.
• Monitor WordPress option retrieval activity that references PDFCrowd credentials.

How to Mitigate CVE-2026-92807

Immediate Actions Required

• Update the Save as PDF Plugin by PDFCrowd to a version above 4.6.1 as soon as the vendor publishes a fix.
• Rotate the PDFCrowd API key and username stored in WordPress options in case they were exposed.
• Review Contributor-level accounts and remove any that are unnecessary or inactive.
• Audit recent posts and revisions for shortcodes carrying a pdf_created_callback attribute and remove them.

Patch Information

Refer to the vendor's WordPress Plugin Changeset for the corrective code changes. Confirm the installed version is above 4.6.1 through the WordPress plugins screen after updating.

Workarounds

• Deactivate the Save as PDF Plugin by PDFCrowd until a patched release is installed.
• Restrict the ability to publish or edit posts containing shortcodes to Editor or Administrator roles only.
• Block unauthenticated POST requests to admin-ajax.php with action=save_as_pdf_pdfcrowd at the web application firewall.
• Remove or restrict the wp_ajax_nopriv_save_as_pdf_pdfcrowd handler through a custom must-use plugin if immediate patching is not possible.

# Example WAF rule (ModSecurity syntax) to block unauthenticated exploitation
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1092807,msg:'Block CVE-2026-92807 PDFCrowd AJAX'"
  SecRule ARGS:action "@streq save_as_pdf_pdfcrowd" \
    "chain"
  SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"