CVE-2026-92807

Overview

The Save as PDF Plugin by PDFCrowd for WordPress suffers from an arbitrary function invocation vulnerability in versions up to 4.6.1. The flaw occurs because user-supplied shortcode attributes are unsanitized and later invoked as PHP callables via an unauthenticated AJAX endpoint. This allows low-privileged authenticated users to trigger unauthorized function executions and potentially disclose sensitive API credentials.

Description

The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and including, 4.6.1 via the `pdf_created_callback` shortcode attribute. The `eval_shortcode()` function copies any non-`button_`/non-`email_` shortcode attribute verbatim into a custom options array without sanitization, allowlist enforcement, or capability checks, and `create_button()` AES-encrypts that array — including the attacker-supplied callback value — and embeds the resulting blob in the rendered button HTML; when the blob is later POSTed to the unauthenticated `wp_ajax_nopriv_save_as_pdf_pdfcrowd` endpoint, `save_as_pdf_pdfcrowd()` decrypts it and invokes `$options['pdf_created_callback']` as a PHP callable at line 1722 with no `is_callable()` guard, no allowlist, and no capability check. This makes it possible for authenticated attackers, with Contributor-level access and above, to invoke arbitrary PHP functions or static class methods with plugin option data as the sole argument, enabling disclosure of the site's stored PDFCrowd API key and username or further server-side abuse. Note that the encryption boundary does not mitigate this vector because the server itself encrypts the attacker-chosen callback during shortcode rendering, supplying any authenticated Contributor with a cryptographically valid blob that any unauthenticated visitor can subsequently replay to trigger invocation.

Impact

Integrity and confidentiality are impacted as authenticated attackers with Contributor-level access can invoke arbitrary PHP functions or static class methods. This can lead to the disclosure of stored API keys and usernames, or further server-side abuse. The vulnerability affects all WordPress sites utilizing vulnerable versions of the PDFCrowd plugin.

Remediation

Update the Save as PDF Plugin by PDFCrowd to version 4.6.2 or later immediately once a patched version is made available by the vendor. As an interim mitigation, disable the plugin or restrict shortcode usage to trusted administrative roles only.

Risk context

Rated as critical with a CVSS score of 8.8, indicating severe risk if exploited. Although the current EPSS is relatively low at 0.00254, the ability for low-privileged users to achieve function invocation warrants prompt remediation.

Affected products

• PDFCrowd Save as PDF Plugin for WordPress