Vulnerabilities / Document Engine / WPSEC-2026-0148
Document Engine <= 1.3 - Authenticated (Author+) Server-Side Request Forgery via Post to PDF Images
Medium 5.0
CWE-918Fixed in 2.0.0
- ID
- WPSEC-2026-0148
- Plugin
- Document Engine – Document Library, PDF Viewer & Post to PDF (document-engine)
- Affected
- all versions before 2.0.0
- Remediation
- Update to 2.0.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
- Weakness
- CWE-918
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Document Engine on WPSec AttackSurface
- Fix released
- Published
Description
The Document Engine plugin for WordPress is vulnerable to Server-Side Request Forgery via the Post to PDF feature in all versions up to, and including, 1.3. The bundled mPDF library fetches the remote images and stylesheets referenced in post content without blocking internal or private network addresses. This makes it possible for authenticated attackers with Author-level access and above, who can publish posts, to make the web server send requests to internal network locations by publishing a post that references them and requesting its PDF export. Image responses are embedded in the generated PDF.
References
- https://wpsec.com/vuln/WPSEC-2026-0148/
- https://plugins.svn.wordpress.org/document-engine/tags/2.0.0/
- https://wordpress.org/plugins/document-engine/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS