diff --git a/public_html/wp-content/plugins/wordcamp-docs/classes/class-wordcamp-docs-pdf-generator.php b/public_html/wp-content/plugins/wordcamp-docs/classes/class-wordcamp-docs-pdf-generator.php
index 5c86510b9..acb0e3351 100644
--- a/public_html/wp-content/plugins/wordcamp-docs/classes/class-wordcamp-docs-pdf-generator.php
+++ b/public_html/wp-content/plugins/wordcamp-docs/classes/class-wordcamp-docs-pdf-generator.php
@@ -72,7 +72,8 @@ public function generate_pdf_from_file( $source_file, $filename, $args = array()
$file = $this->get_tmp_folder( $filename );
$command = sprintf(
- 'wkhtmltopdf -d %d -T %s -R %s -B %s -L %s %s %s',
+ // Allowing local file access is safe because the inputs to `$source_file` should have been escaped.
+ 'wkhtmltopdf --enable-local-file-access -d %d -T %s -R %s -B %s -L %s %s %s',
$dpi,
escapeshellarg( $margins[0] ),
escapeshellarg( $margins[1] ),