The Save as PDF Plugin for WordPress contains a high-severity arbitrary function invocation vulnerability that allows authenticated users to execute unauthorized PHP code, posing a significant risk of site compromise.

This flaw is an improper control of code generation (CWE-94) where the plugin fails to sanitize or validate the pdf_created_callback parameter. An authenticated attacker with Contributor-level access or higher can trigger the execution of arbitrary PHP functions or static class methods on the server.

The ability to invoke arbitrary PHP functions allows an attacker to access sensitive configuration data, such as PDFCrowd API keys and usernames, or potentially achieve deeper server-side exploitation. With a CVSS score of 8.8, this vulnerability is considered critical for site integrity and confidentiality. A successful exploit could lead to full unauthorized access to site data or further malicious activity originating from the compromised server.

Immediate Action: Update the Save as PDF Plugin by PDFCrowd to version 4.6.2 or later immediately to resolve the vulnerable code path.

Proactive Monitoring: Monitor server access and error logs for unexpected POST requests directed at the wp_ajax_nopriv_save_as_pdf_pdfcrowd endpoint, particularly those originating from user accounts with Contributor privileges.

Compensating Controls: If an immediate update is not feasible, restrict plugin access to administrative users or disable the plugin entirely to prevent exploitation of the insecure shortcode attribute.

Public Exploit Available: No

Given the high CVSS score and the nature of the vulnerability, organizations using the Save as PDF Plugin by PDFCrowd should treat this as a priority update. Administrators must ensure all instances are patched to version 4.6.2 to eliminate the risk of arbitrary code execution, as the current implementation lacks the necessary security guards to prevent abuse by authenticated users.