CVE-2026-16567 in Document Embedder Plugin
Summary
by MITRE • 08/27/2026
The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by enumerating IDs.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in versions of the Document Embedder WordPress plugin prior to release 2.3.1 represents a critical failure in access control mechanisms, specifically classified under CWE-602 as Client-Side Enforcement of Server-Side Security and CWE-862 as Missing Authorization Check. This flaw stems from an architectural oversight where the application logic responsible for generating download tokens fails to validate the current status or visibility settings associated with the target document within the WordPress content management system database before proceeding with file transmission. By neglecting this essential verification step, the plugin inadvertently exposes a mechanism that allows any user interacting with the endpoint to retrieve files regardless of their intended privacy level.
From an operational perspective, this deficiency enables unauthenticated attackers to perform ID enumeration attacks against the application's document repository. Since WordPress typically utilizes sequential or predictable integer identifiers for posts and custom post types such as documents, an attacker can systematically iterate through these IDs to discover valid resources. Once a valid identifier is found, the flawed logic issues a download token without verifying whether the associated document is marked as private, draft, password-protected, or otherwise restricted from public view. This effectively bypasses the native security controls provided by the WordPress platform, turning what should be internal-only content into publicly accessible data.
The impact of this vulnerability extends beyond simple unauthorized access to sensitive files. It facilitates a significant breach of confidentiality for organizations relying on Document Embedder to host proprietary information, client documents, or unpublished drafts. Attackers can harvest these documents without needing valid credentials, leading to potential intellectual property theft, exposure of confidential business strategies, and violation of data protection regulations such as GDPR if personal identifiable information is contained within the leaked files. Furthermore, this vulnerability aligns with ATT&CK technique T1078, Valid Accounts, in the sense that it allows access to resources without proper authentication or authorization credentials, effectively granting unauthorized users privileges equivalent to those intended only for authenticated administrators or specific user roles depending on how private posts are configured.
To mitigate this risk, immediate action is required by upgrading the Document Embedder plugin to version 2.3.1 or later, where the developers have implemented proper checks to verify document status before issuing download tokens. In addition to updating software, system administrators should review their WordPress configuration to ensure that sensitive documents are stored in locations with restricted file permissions and consider implementing additional web application firewall rules to detect and block enumeration patterns targeting post ID parameters. Regular security audits of custom plugins are also recommended to identify similar logic flaws where server-side state is not correctly validated against client requests, ensuring robust enforcement of access control policies across all digital assets hosted on the platform.