CVE-2026-66710

HighCVSS 8.1

Published: 06/08/2026(UTC)Updated: 12/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

23th percentile - higher than 23% of all known CVEs

Summary

Local File Inclusion (LFI) vulnerability in e2pdf plugin up to version 1.32.40, allowing an unauthenticated attacker to read local files on the server.

Risk Assessment

An attacker can access sensitive files such as configuration, user data, or passwords, potentially leading to full system compromise.

Recommendation

Update the e2pdf plugin to the latest version that includes a fix for this vulnerability.

Other vulnerabilities in e2pdf

CVE-2026-42681High
The e2pdf WordPress plugin (versions up to 1.32.14) has a Reflected Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation.

Original NVD description (English source)

Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions.