The PDFDraft WordPress plugin lacks an authorization check on its serveTemplatePdfAjax() function and the REST route serveTemplatePdf, which is registered with permission_callback => '__return_true'. This defect allows any visitor to download stored template PDFs by accessing the publicly registered admin‑ajax action pdfdraft_embed_pdf or the REST endpoint /wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf, provided a design slug is known or can be guessed. The exposed PDFs may contain customer PII, invoices, orders, or certificates, leading to a confidentiality breach for affected sites.

All installations of the PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin from wpeverest with a version of 1.1.0 or earlier are affected. WordPress sites that have deployed these plugin releases are potentially vulnerable until patched or the capability check is added.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is HTTP requests to a public endpoint that bypasses authentication. An attacker can exploit the public endpoint from any location over the network, bypassing authentication entirely by supplying a guessed or known slug identifier. If successful, the attacker gains complete access to the underlying PDF templates, resulting in exposure of sensitive business data.