CVE-2026-92807: Arbitrary Function Invocation in Save as PDF Plugin for WordPress

The Save as PDF Plugin by PDFCrowd for WordPress (all versions up to and including 4.6.1) contains an arbitrary function invocation vulnerability in the save_as_pdf_pdfcrowd() function. The flaw exists because the plugin fails to sanitize or validate shortcode attributes passed to the eval_shortcode() function. Specifically, the pdf_created_callback attribute is copied into an options array, which is then encrypted using AES and embedded into the rendered HTML output.

When this button is accessed, the encrypted blob is POSTed to the wp_ajax_nopriv_save_as_pdf_pdfcrowd endpoint. The server decrypts this blob and invokes the value of $options['pdf_created_callback'] as a PHP callable at line 1722 without verifying if the target is a valid callable or checking user capabilities. Because the server itself performs the encryption during page rendering, an attacker with Contributor access can inject a malicious callback into a post or page, receive the valid encrypted blob from the server, and then trigger the arbitrary function via an unauthenticated request. This allows for the disclosure of sensitive plugin data like API keys or usernames.

Impact

Successful exploitation allows authenticated users with Contributor-level access and above to execute arbitrary PHP functions or static class methods on the underlying WordPress server. This leads to the disclosure of sensitive configuration data, including PDFCrowd API credentials, or potential further server-side abuse. Given the popularity of WordPress plugins, this vulnerability presents a significant risk to any site using vulnerable versions of this plugin.

Recommendation

1. Patch CVE-2026-92807 by updating the Save as PDF Plugin to the latest available version beyond 4.6.1 immediately.
2. Implement an allowlist for the pdf_created_callback parameter in the plugin configuration if an immediate patch is not possible.
3. Deploy the Sigma rules below to monitor for suspicious AJAX requests to the vulnerable endpoint and tune for your environment.