E2Pdf – Export Pdf Tool for WordPress Security & Risk Analysis

The e2pdf plugin v1.32.05 presents a moderate security risk due to a significant number of unprotected AJAX handlers and concerning patterns identified in its code signals and vulnerability history. While the plugin demonstrates some good security practices, such as using prepared statements for a majority of its SQL queries and implementing a substantial number of nonce and capability checks, the 22 unprotected AJAX handlers represent a considerable attack surface that could be exploited by unauthenticated users.

The static analysis reveals the presence of dangerous functions like `preg_replace(/e)` and `unserialize`, coupled with taint analysis indicating 3 flows with unsanitized paths, two of which are high severity. This suggests potential vulnerabilities such as Cross-Site Scripting (XSS) or Remote Code Execution (RCE) if input is not properly sanitized before being processed by these functions. Furthermore, only 47% of output is properly escaped, increasing the risk of XSS vulnerabilities.

The plugin's vulnerability history of 9 known CVEs, including high-severity issues like SQL Injection, Cross-Site Request Forgery (CSRF), and Deserialization of Untrusted Data, reinforces these concerns. Although there are no currently unpatched vulnerabilities, the recurring nature and types of past vulnerabilities suggest a persistent need for rigorous security auditing and patching by the developers. The last reported vulnerability was in October 2025, which is concerning if the current version is 1.32.05, suggesting a potential gap in proactive security updates or an issue with the timestamp reporting.