CVE-2026-92807 is a code injection vulnerability (CWE-94) in the Save as PDF Plugin by PDFCrowd for WordPress, affecting all versions up to and including 4.6.1. The vulnerability arises from the eval_shortcode() function copying shortcode attributes without sanitization or allowlist enforcement into a custom options array, which is AES-encrypted and embedded in button HTML. When this encrypted blob is POSTed to an unauthenticated AJAX endpoint, it is decrypted and the pdf_created_callback option is invoked as a PHP callable without any is_callable() check, allowlist, or capability verification. Authenticated users with Contributor-level privileges can supply arbitrary callbacks that get executed server-side, enabling disclosure of stored API credentials or further abuse.

An attacker with Contributor-level access can exploit this vulnerability to execute arbitrary PHP functions or static methods on the server, potentially disclosing sensitive information such as the site's PDFCrowd API key and username. This can lead to full server-side compromise, data leakage, and unauthorized actions within the WordPress environment. The vulnerability does not require UI interaction and can be triggered via crafted shortcode attributes and replayed encrypted blobs.

No official patch or fix is currently documented for this vulnerability. Users should check the vendor advisory for updates. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the Save as PDF Plugin by PDFCrowd if possible. Monitor for plugin updates that address this issue.