{"id":"CVE-2026-122671","kind":"vulnerability","aliases":["CVE-2026-122671"],"related":[],"title":"e2pdf WordPress plugin: missing authorization lets users bypass access controls","description":"Missing Authorization vulnerability in E2Pdf.com e2pdf e2pdf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects e2pdf: from n/a through 1.32.65.","summary":"The e2pdf PDF-generation plugin by E2Pdf.com has a missing authorization check, so access control settings are not enforced. An attacker who can reach the affected feature can get access to data or actions they should not have.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e2pdf","package","wordpress"],"not_affected_if":[],"how_to_check":"- Check the installed e2pdf version and see whether it is `1.32.65` or earlier.\n- Look for the e2pdf plugin in the WordPress plugin list or the plugin directory.","fix":"- Versions after `1.32.65` are affected; the sources do not name a fixed version.","status":"open","published_at":"2026-11-11T12:19:39+00:00","first_seen_at":"2026-11-11T12:27:10+00:00","triaged_at":"2026-11-11T12:28:36+00:00","updated_at":"2026-11-11T12:28:36+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-11T12:28:36Z","model":"claude-haiku-5-5","output":{"fix":"- Versions after `1.32.65` are affected; the sources do not name a fixed version.","reach":"unknown","title":"e2pdf WordPress plugin: missing authorization lets users bypass access controls","impact":"medium","summary":"The e2pdf PDF-generation plugin by E2Pdf.com has a missing authorization check, so access control settings are not enforced. An attacker who can reach the affected feature can get access to data or actions they should not have.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","e2pdf"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized access to data or actions the access controls should block","analyst_note":"Confirm the affected product ecosystem, the vulnerable feature, the required privilege, and the fixed version from the NVD and vendor pages.","how_to_check":"- Check the installed e2pdf version and see whether it is `1.32.65` or earlier.\n- Look for the e2pdf plugin in the WordPress plugin list or the plugin directory.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Sites running the e2pdf plugin at version 1.32.65 or earlier are in scope according to the NVD description. The sources do not describe the exact configuration or role needed to trigger the flaw, so whether an unauthenticated visitor can reach it is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000723,"input_tokens":4548,"output_tokens":537,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-122671':13A,16A '-2026':12A,15A '1.32.65':76C 'access':9A,34B,50B,66C 'action':54B 'affect':46B,71C 'allow':62C 'attack':41B 'author':5A,31B,56C 'bypass':8A 'check':32B 'configur':65C 'control':10A,35B,67C 'cve':11A,14A 'data':52B 'e2pdf':1A,17B,21B,60C,61C,72C 'e2pdf.com':27B,59C 'enforc':39B 'exploit':63C 'featur':47B 'generat':24B 'get':49B 'incorrect':64C 'issu':70C 'let':6A 'levels.this':69C 'miss':4A,30B,55C 'n/a':74C 'packag':18B 'pdf':23B 'pdf-gener':22B 'plugin':3A,25B 'reach':44B 'secur':68C 'set':36B 'user':7A 'vulner':57C 'wordpress':2A,19B","nicknames":[],"mitigations":[],"who_affected":"Sites running the e2pdf plugin at version 1.32.65 or earlier are in scope according to the NVD description. The sources do not describe the exact configuration or role needed to trigger the flaw, so whether an unauthenticated visitor can reach it is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["e2pdf","medium","package","wordpress"],"campaign_type":null,"search_a":"'-122671':13A,16A '-2026':12A,15A 'access':9A 'author':5A 'bypass':8A 'control':10A 'cve':11A,14A 'e2pdf':1A 'let':6A 'miss':4A 'plugin':3A 'user':7A 'wordpress':2A","search_b":"'access':34B,50B 'action':54B 'affect':46B 'attack':41B 'author':31B 'check':32B 'control':35B 'data':52B 'e2pdf':17B,21B 'e2pdf.com':27B 'enforc':39B 'featur':47B 'generat':24B 'get':49B 'miss':30B 'packag':18B 'pdf':23B 'pdf-gener':22B 'plugin':25B 'reach':44B 'set':36B 'wordpress':19B","search_c":"'1.32.65':76C 'access':66C 'affect':71C 'allow':62C 'author':56C 'configur':65C 'control':67C 'e2pdf':60C,61C,72C 'e2pdf.com':59C 'exploit':63C 'incorrect':64C 'issu':70C 'levels.this':69C 'miss':55C 'n/a':74C 'secur':68C 'vulner':57C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T12:19:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122671","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122671","severity":null,"published_at":"2026-11-11T12:19:39+00:00","modified_at":"2026-11-11T12:19:39+00:00","first_seen_at":"2026-11-11T12:27:10+00:00","fetched_at":"2026-11-11T12:27:10+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}