The vulnerability lies in the E2Pdf – Export Pdf Tool for WordPress plugin where the screen_action() endpoint fails to perform a capability check or nonce verification. The function reads arbitrary option names and values from the wp_screen_options POST variable and forwards them directly to WordPress’s update_option() call, making it a CWE-862 missing authorization flaw. An attacker who is authenticated and has been granted the e2pdf_templates capability, which the plugin allows to be assigned to any role, can overwrite any WordPress option such as default_role. This enables the attacker to elevate privileges to Administrator, compromising the confidentiality, integrity, and availability of the site.

The issue affects the Oleksandrz E2Pdf – Export Pdf Tool for WordPress plugin for WordPress. All releases up to and including version 1.32.26 are vulnerable. Users running any earlier version in that range are susceptible.

The flaw scores a CVSS of 8.8, indicating high severity. EPSS is reported as < 1 %, suggesting a low likelihood of exploitation in the wild at present. The vulnerability is not yet listed in the CISA KEV catalog. The attack requires an authenticated user with the e2pdf_templates capability; by sending a crafted POST request to the ?action=screen route, the attacker bypasses nonce verification and can update any option. The potential impact is full privilege escalation to an Administrator level.