CVE-2020-37254
Wondershare PDFelement 5.2.9 Privilege Escalation via Unquoted Service Path
CVSS Score
7.8
EPSS Score
0.0%
EPSS Percentile
0th
Wondershare PDFelement 5.2.9 contains a privilege escalation vulnerability due to an unquoted service path in the WsAppService Windows service. Local attackers can place a malicious executable in the service path and execute code with LocalSystem privileges upon service restart or system reboot.
| CWE | CWE-428 |
| Vendor | wondershare |
| Product | pdfelement |
| Published | Jun 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for wondershare pdfelement
Be the first to know when new high vulnerabilities affecting wondershare pdfelement are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Wondershare / PDFelement
5.2.9
References
exploit-db.com: https://www.exploit-db.com/exploits/40535 wondershare.com: https://www.wondershare.com/ download.wondershare.com: http://download.wondershare.com/inst/pdfelement_setup_full1042.exe vulncheck.com: https://www.vulncheck.com/advisories/wondershare-pdfelement-privilege-escalation-via-unquoted-service-path
Credits
Saeed Hasanzadeh (Net.Hun73r)