CVE-2026-1389
Insecure Direct Object Reference in Document Embedder Plugin Allows Data Manipulation
Publication date: 2026-01-28
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| document_embedder | embed_pdfs_word_excel_and_other_files | to 2.0.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Insecure Direct Object Reference (IDOR) in the Document Embedder plugin for WordPress, affecting all versions up to 2.0.4. It occurs because the plugin does not verify if a user has permission to access certain resources in specific AJAX actions ('bplde_save_document_library', 'bplde_get_single', and 'bplde_delete_document_library'). As a result, authenticated users with Author-level access or higher can read, modify, or delete Document Library entries created by other users, including administrators, by manipulating the 'id' parameter.
How can this vulnerability impact me? :
This vulnerability allows authenticated users with Author-level access or above to access, modify, or delete documents in the Document Library that belong to other users, including administrators. This can lead to unauthorized disclosure, alteration, or loss of important documents, potentially disrupting operations or compromising sensitive information within the WordPress site.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update the Document Embedder plugin to a version later than 2.0.4 where the issue is fixed. Additionally, restrict Author-level access and above to trusted users only, as the vulnerability allows authenticated users with Author-level access to exploit it. Monitor and audit user actions related to the Document Library entries to detect unauthorized access or modifications.