https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 22:41:46 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-341959 EUVD-2026-341959 https://cve.radiocsirt.org/vuln/euvd-2026-341959 https://cve.radiocsirt.org/vuln/fkie_cve-2026-12124 <p>The PDFDraft – Drag &amp; Drop PDF Builder, PDF Viewer, Embed &amp; Download PDF, Certificate &amp; Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax() function and the serveTemplatePdf() REST route (which is registered with `permission_callback =&gt; &#39;__return_true&#39;`) in versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to download stored template PDFs — which may contain customer PII, invoice, order, and certificate data — by requesting the publicly registered admin-ajax action `pdfdraft_embed_pdf` or the REST endpoint `/wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf` with a known or guessable design slug, bypassing the plugin&#39;s own .</p> <p>The PDFDraft – Drag &amp; Drop PDF Builder, PDF Viewer, Embed &amp; Download PDF, Certificate &amp; Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax() function and the serveTemplatePdf() REST route (which is registered with `permission_callback =&gt; &#39;__return_true&#39;`) in versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to download stored template PDFs — which may contain customer PII, invoice, order, and certificate data — by requesting the publicly registered admin-ajax action `pdfdraft_embed_pdf` or the REST endpoint `/wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf` with a known or guessable design slug, bypassing the plugin&#39;s own .</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-12124 https://cve.radiocsirt.org/vuln/ghsa-vqr6-98r6-wqvg <p>The PDFDraft – Drag &amp; Drop PDF Builder, PDF Viewer, Embed &amp; Download PDF, Certificate &amp; Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax() function and the serveTemplatePdf() REST route (which is registered with `permission_callback =&gt; &#39;__return_true&#39;`) in versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to download stored template PDFs — which may contain customer PII, invoice, order, and certificate data — by requesting the publicly registered admin-ajax action `pdfdraft_embed_pdf` or the REST endpoint `/wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf` with a known or guessable design slug, bypassing the plugin&#39;s own .</p> <p>The PDFDraft – Drag &amp; Drop PDF Builder, PDF Viewer, Embed &amp; Download PDF, Certificate &amp; Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax() function and the serveTemplatePdf() REST route (which is registered with `permission_callback =&gt; &#39;__return_true&#39;`) in versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to download stored template PDFs — which may contain customer PII, invoice, order, and certificate data — by requesting the publicly registered admin-ajax action `pdfdraft_embed_pdf` or the REST endpoint `/wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf` with a known or guessable design slug, bypassing the plugin&#39;s own .</p> https://cve.radiocsirt.org/vuln/ghsa-vqr6-98r6-wqvg