Document Engine <= 1.3 - Unauthenticated Sensitive Information Exposure via Post to PDF Export
- ID
- WPSEC-2026-0147
- Plugin
- Document Engine – Document Library, PDF Viewer & Post to PDF (document-engine)
- Affected
- all versions before 2.0.0
- Remediation
- Update to 2.0.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Document Engine on WPSec AttackSurface
- Fix released
- Published
Description
The Document Engine plugin for WordPress is vulnerable to Sensitive Information Exposure via the Post to PDF export (the 'generate_pdf' query parameter) in all versions up to, and including, 1.3. The export only checks that the requested post ID has the 'publish' status. It does not check that the post type is publicly viewable or enabled for PDF export, and it runs on the 'wp' hook, before access-control plugins that act on 'template_redirect'. This makes it possible for unauthenticated attackers to export, as PDF files, the content of published posts of non-public post types (for example reusable blocks, or form configurations that form plugins store as posts), and to bypass redirect-based access restrictions such as site-wide login requirements. Draft and private posts are not exposed, and WordPress core already hides the content of password-protected posts.
References
- https://wpsec.com/vuln/WPSEC-2026-0147/
- https://plugins.svn.wordpress.org/document-engine/tags/2.0.0/
- https://wordpress.org/plugins/document-engine/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS