CVE-2026-12407 is a missing authorization vulnerability (CWE-862) in the E2Pdf – Export Pdf Tool for WordPress plugin. The issue occurs because the screen_action() function does not perform a dedicated capability check or nonce verification, bypassing the nonce gate in index_action(). It reads attacker-controlled data from $_POST['wp_screen_options'] and passes it directly to update_option() without an allowlist. The plugin's permissions UI allows administrators to grant the e2pdf_templates capability to any role, including low-privilege roles like Subscriber or Contributor. An authenticated attacker with such a role can exploit this to overwrite critical WordPress options, such as default_role, thereby escalating privileges to administrator.

An authenticated user with a role granted the e2pdf_templates capability can overwrite arbitrary WordPress options, including default_role, enabling privilege escalation to administrator. This compromises the confidentiality, integrity, and availability of the WordPress site, as the attacker gains full administrative control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the assignment of the e2pdf_templates capability to trusted roles only and avoid granting it to low-privilege roles such as Subscriber, Contributor, Author, or Editor. Monitor for updates from the plugin vendor and apply official patches once released.