Description

The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by enumerating IDs.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-27T06:16:56.013Z",
  "pubdate": "2026-08-27T06:16:56.013Z",
  "executiveSummary": "The Document Embedder WordPress plugin prior to version 2.3.1 contains an IDOR (Insecure Direct Object Reference) vulnerability resulting in unauthorized sensitive information disclosure.\nThe flaw stems from insufficient access control checks regarding document status when a file download request is processed. By manipulating the document ID parameters, an unauthenticated attacker can bypass restrictions intended to protect non-public content.\nThis vulnerability allows remote, unauthenticated attackers to download arbitrary files managed by the plugin, including documents explicitly marked as private or in draft status.\nThe risk implication is significant as it facilitates the exfiltration of confidential internal data, proprietary information, or sensitive user documents without requiring elevated privileges or authenticated sessions.\nExploitation requires only network access to the target WordPress site and the ability to enumerate valid document IDs, which are often sequential or guessable.",
  "technicalDetails": "The Document Embedder WordPress plugin manages document objects through a centralized system that relies on unique identifier (ID) referencing for file retrieval and streaming. The vulnerability is located within the plugin's download handler logic, which fails to perform an authorization check against the database status of the requested document before initiating the stream.\nThe root cause is a lack of server-side validation regarding the 'post_status' or equivalent availability flag. In a secure implementation, the plugin should verify that the current user has the necessary permissions to access a document of a specific state (e.g., 'publish') before generating a download token.\nThe attack flow proceeds as follows: An attacker identifies the endpoint responsible for document retrieval. By incrementing or iterating through numerical ID parameters passed to the request, the attacker triggers the plugin's file download mechanism. Because the backend code does not validate whether the document is intended to be public, the server retrieves the file from the underlying storage regardless of the document's visibility settings.\nSpecifically, the component responsible for generating the download token and subsequently streaming the binary data to the client-side browser assumes that the request is legitimate if the ID exists in the database. This behavior bypasses WordPress's standard content visibility logic (such as 'private' or 'draft' post types).\nBecause there is no authentication requirement enforced at the API or endpoint level, the attack is fully exploitable by unauthenticated actors over the network. The payload is minimal, often consisting of a standard HTTP GET request with a manipulated query parameter. Success in this enumeration attack allows the attacker to systematically download all files managed by the plugin by iterating through possible ID ranges.\nPost-exploitation impact includes the full exposure of potentially sensitive files that the site administrators intended to keep private. If the Document Embedder plugin is used to host internal policy documents, financial statements, or user-specific reports, this vulnerability provides a direct pathway for unauthorized data exfiltration."
}