WordPress Plugin Vulnerabilities

Document Embedder < 1.7.5 - Unauthenticated Arbitrary Private/Draft Post Title Disclosure

Description

The plugin contains a REST endpoint, which could allow unauthenticated users to enumerate the title of arbitrary private and draft posts.

Proof of Concept

Affects Plugins

Plugin icon
document-emberdder
Fixed in 1.7.5

References

CVE
CVE-2021-24775

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
apple502j
Submitter
apple502j
Verified
Yes
WPVDB ID
c6f24afe-d273-4f87-83ca-a791a385b06b

Timeline

Publicly Published
2022-01-03 (about 3 years ago)
Added
2022-01-03 (about 3 years ago)
Last Updated
2022-04-12 (about 3 years ago)

Other

Published
Title
Published
2025-12-12
Title
Ultimate Auction <= 4.3.2 - Unauthenticated Information Exposure
Published
2023-09-08
Title
EWWW Image Optimizer < 7.2.1 - Sensitive Information Exposure
Published
2024-04-05
Title
User Spam Remover < 1.1 - Unauthenticated Sensitive Information Exposure
Published
2024-04-09
Title
WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score < 7.1.0 - Sensitive Information Exposure via insufficiently protected files
Published
2025-10-10
Title
WP Gmail SMTP <= 1.0.7 - Sensitive Information Exposure