Wordfence Advisory: PDFDraft Plugin Unauth Sensitive PDF Disclosure via Missing Authorization (CVE-2026-12124)

Vulnerability Overview Vulnerability Name: PDFDraft <= 1.1.0 - Missing Authorization Leading to Unauthenticated Sensitive PDF Disclosure via 'slug' Parameter CVE ID: CVE-2026-12124 CVSS Score: 5.3 (Medium) Publication Date: July 27, 2026 Last Updated Date: July 28, 2026 Researcher: sir40 Impact Scope Software Type: Plugin Software Name: PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer Affected Versions: <= 1.1.0 Fixed Version: 1.1.1 Remediation Remediation Method: Update to version 1.1.1 or any subsequent fixed version. Vulnerability Description The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin contains an unauthorized access vulnerability allowing unauthenticated users to access sensitive PDF files. This issue stems from a lack of authorization checks on the function and the REST route. Attackers can bypass the plugin's security mechanisms by requesting the public action or the REST endpoint to download template PDFs containing customer PII, invoices, orders, and certificate data. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Share Options Facebook X (Twitter) LinkedIn Email Additional Information Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7 support with a 1-hour response time Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Contact Information Email: wfi-support@wordfence.com Disclaimer Disclaimer: The content on this page is copyrighted. See the terms at the bottom of the page for details. Other Links Terms of Service: Terms of Service Privacy Policy and Notice at Collection: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Social Media X: X Facebook: Facebook YouTube: YouTube Instagram: Instagram Products and Services Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Support: - Documentation - Learning Center - Free Support - Premium Support News: - Blog - In The News - Vulnerability Advisories About: - About Wordfence - Affiliate Program - Employment - Contact - Security - CVE Request Form Subscribe for Updates Subscribe: Sign up for news and updates from our panel of experienced security professionals. Footer Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Logo: Wordfence

Goal Reached Thanks to every supporter — we hit 100%!

Wordfence Advisory: PDFDraft Plugin Unauth Sensitive PDF Disclosure via Missing Authorization (CVE-2026-12124)