CVE-2026-45443

Executive Summary

CVE-2026-45443 is a Missing Authorization vulnerability in the PDF for Elementor Forms + Drag And Drop Template Builder plugin for WordPress, developed by ADD-ONS.ORG. This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions such as viewing or modifying PDF templates and form data. The vulnerability affects all versions from n/a through 5.5.1. As a WordPress plugin issue, the attack surface is limited to sites running this specific plugin, and the root cause lies in the plugin’s failure to properly enforce capability checks on certain AJAX actions or REST endpoints.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and third-party marketplaces. Since no patch has been released, users are advised to disable the plugin until a fix is available. The lack of a patch increases supply chain risk, as malicious actors could exploit this to inject backdoors or exfiltrate data from affected sites.

CVSS Breakdown & Threat Level

• CVSS Score: 5.0 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The low EPSS score (0.0%) suggests that exploitation is not currently widespread, but the lack of a patch and the ease of exploitation (no authentication required) make this a high-priority target for automated scanning.

Deep Dive & Mechanics

The vulnerability resides in the plugin’s AJAX handlers or REST API endpoints that are used to manage PDF templates and form submissions. The plugin fails to verify that the current user has the necessary capabilities (e.g., edit_posts, manage_options) before processing requests. This allows any unauthenticated visitor to:

• List, view, or modify PDF templates.
• Access form submission data that should be restricted to administrators.
• Potentially upload malicious files if the plugin uses file handling without proper authorization.

The core issue is a classic Missing Authorization (CWE-862) where the plugin assumes that if a request reaches a certain handler, the user is already authenticated and authorized. This is common in WordPress plugins that register AJAX actions for both authenticated and unauthenticated users but fail to add capability checks.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern. A typical vulnerable code snippet might look like:

// Vulnerable: No capability check
add_action('wp_ajax_nopriv_pdf_ef_get_templates', 'pdf_ef_get_templates');
function pdf_ef_get_templates() {
    // Directly returns all templates without checking user role
    $templates = get_posts(array('post_type' => 'pdf_template', 'posts_per_page' => -1));
    wp_send_json($templates);
}

A patched version would include a capability check:

// Patched: Check user capability
add_action('wp_ajax_pdf_ef_get_templates', 'pdf_ef_get_templates');
function pdf_ef_get_templates() {
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized', 403);
    }
    $templates = get_posts(array('post_type' => 'pdf_template', 'posts_per_page' => -1));
    wp_send_json($templates);
}

Note: The nopriv_ prefix in the vulnerable version allows unauthenticated access, while the patched version removes it and adds a capability check.

Exploitation & Lab Setup

Red Team (Exploitation)

To exploit this vulnerability, an attacker would send crafted HTTP requests to the vulnerable AJAX endpoints. Since no public exploit code is available, we provide a conceptual example using curl:

# Example: List all PDF templates (unauthenticated)
curl -X POST "https://target.com/wp-admin/admin-ajax.php" \
  -d "action=pdf_ef_get_templates"

If the endpoint returns data without authentication, the vulnerability is confirmed. The attacker could then attempt to modify or delete templates by guessing other action names (e.g., pdf_ef_delete_template, pdf_ef_update_template).

Blue Team (Detection & Hardening)

• Immediate Action: Disable the plugin until a patch is released.
• Web Application Firewall (WAF): Block requests to admin-ajax.php with suspicious action parameters related to the plugin (e.g., pdf_ef_*).
• Log Monitoring: Monitor for unusual POST requests to /wp-admin/admin-ajax.php with action parameters starting with pdf_ef_ from unauthenticated IPs.
• File Integrity Monitoring: Check for unauthorized changes to PDF template posts or plugin files.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with action=pdf_ef_* parameters from unauthenticated sources.
• File: Unexpected modifications to posts of type pdf_template or elementor_forms entries.
• Log: WordPress debug log entries showing wp_ajax_nopriv_pdf_ef_* calls.
• System: New user accounts with elevated privileges (if the vulnerability is chained with other flaws).

Detection Engineering

YARA Rule

rule CVE_2026_45443_WordPress_Plugin {
    meta:
        description = "Detects vulnerable PDF for Elementor Forms plugin files"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $vuln_ajax = "wp_ajax_nopriv_pdf_ef_" ascii wide nocase
        $vuln_func = "function pdf_ef_" ascii wide nocase
    condition:
        $vuln_ajax or $vuln_func
}

Sigma Rule

title: CVE-2026-45443 - Missing Authorization in PDF for Elementor Forms
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated access to vulnerable AJAX endpoints
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains|all:
            - 'action=pdf_ef_'
    condition: selection
falsepositives:
    - Legitimate admin actions (if logged in)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-45443 - Missing Authorization in PDF for Elementor Forms";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=pdf_ef_"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Disable the plugin pdf-for-elementor-forms until a patched version is released.
2. Short-term: Implement a WAF rule to block requests to admin-ajax.php with action parameters starting with pdf_ef_ from unauthenticated users.
3. Long-term: Monitor the plugin’s official page for updates. When a patch is released, update immediately.
4. Workaround: If the plugin is critical, consider adding custom code to your theme’s functions.php to enforce capability checks:

add_action('init', function() {
    // Remove vulnerable nopriv actions
    remove_action('wp_ajax_nopriv_pdf_ef_get_templates', 'pdf_ef_get_templates');
    // Re-add with capability check
    add_action('wp_ajax_pdf_ef_get_templates', function() {
        if (!current_user_can('edit_posts')) {
            wp_die('Unauthorized', 403);
        }
        // Original function logic here
    });
});

Valters IT
Securing Digital Frontiers