WordPress Plugin Vulnerabilities

Document Embedder < 2.3.1 - Unauthenticated Private Document Download via Token Oracle

Description

The plugin does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary plugin documents, including private and draft ones, by enumerating IDs.

Proof of Concept

Affects Plugins

Plugin icon
document-emberdder
Fixed in 2.3.1

References

CVE
CVE-2026-16567

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Vaibhav Narkhede
Submitter
Vaibhav Narkhede
Verified
Yes
WPVDB ID
abf97927-cee2-44f4-a495-c7571d43be95

Timeline

Publicly Published
2026-08-25 (about 2 days ago)
Added
2026-08-25 (about 1 day ago)
Last Updated
2026-08-25 (about 1 day ago)

Other

Published
Title
Published
2026-01-02
Title
Innovio <= 1.7 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-06-26
Title
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin < 1.1.8 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2025-01-10
Title
Unlimited Theme Addon For Elementor and WooCommerce < 1.2.3 - Authenticated (Contributor+) Post Disclosure
Published
2025-08-14
Title
Order Tip for WooCommerce < 1.5.5 - Unauthenticated Tip Manipulation to Negative Value Leading to Unauthorized Discounts
Published
2025-09-09
Title
WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover