CVE-2023-50849 WordPress e2pdf Plugin <= 1.20.23 is vulnerable to SQL Injection

What is CVE-2023-50849?

CVE-2023-50849 is a high-severity SQL injection vulnerability in E2Pdf.com E2Pdf – Export To Pdf Tool for WordPress, published on 28 Dec 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool for WordPress.This issue affects E2Pdf – Export To Pdf Tool for WordPress: from n/a through 1.20.23.

Weakness: CWE-89

Which versions are affected by CVE-2023-50849?

It affects 1 product.

Products include E2pdf E2pdf.

How do I fix CVE-2023-50849?

No fix has been published for CVE-2023-50849 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2023-50849 being exploited?

There is no known exploitation of CVE-2023-50849 in the wild and no public exploit code.

Other vulnerabilities in E2Pdf.com E2Pdf – Export To Pdf Tool for WordPress

• CVE-2023-6826 E2Pdf <= 1.20.25 - Authenticated (Administrator+) Arbitrary File Upload High 7.2
• CVE-2023-46154 WordPress e2pdf Plugin <= 1.20.18 is vulnerable to PHP Object Injection Medium 6.6
• CVE-2025-62068 WordPress e2pdf plugin <= 1.28.09 - Cross Site Scripting (XSS) vulnerability Medium 6.5
• CVE-2024-43318 WordPress E2Pdf – Export To Pdf Tool for WordPress plugin <= 1.25.05 - Cross Site Scripting (XSS) vulnerability Medium 6.5
• CVE-2024-37415 WordPress E2Pdf plugin <= 1.20.27 - Broken Access Control vulnerability Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-456m-rhjg-6cq3.