WordPress Plugin Vulnerabilities

Save as PDF plugin by Pdfcrowd < 3.2.1 - Missing Authorization

Description

The Save as PDF plugin by Pdfcrowd plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_sample_button() function in versions up to, and including, 3.2.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject malicious web scripts.

Affects Plugins

Plugin icon
save-as-pdf-by-pdfcrowd
Fixed in 3.2.1

References

CVE
CVE-2024-33684
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/d7e18997-90be-4fa4-aa4f-3b79544e00f5

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
6.4 (medium)

Miscellaneous

Original Researcher
Majed Refaea
Verified
No
WPVDB ID
d897cad5-c73d-4aa8-ab60-f438be770b42

Timeline

Publicly Published
2024-04-26 (about 2 years ago)
Added
2024-05-01 (about 2 years ago)
Last Updated
2024-05-01 (about 2 years ago)

Other

Published
Title
Published
2025-11-04
Title
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction < 2.16.5 - Missing Authorization to Unauthenticated Arbitrary Member Subscription Auto Renewal
Published
2025-04-01
Title
Automatic Featured Images from Videos < 1.2.5 - Missing Authorization
Published
2024-06-20
Title
Demo Awesome < 1.0.3 - Missing Authorization
Published
2024-04-25
Title
KB Support < 1.6.1 - Missing Authorization
Published
2024-10-17
Title
WP Easy Post Types <= 1.4.4 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions