CVE-2026-16567

MediumCVSS 5.3

Published: 27/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 27/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

The Document Embedder WordPress plugin before version 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary documents, including private and draft ones, by enumerating IDs.

Risk Assessment

The organization is exposed to leakage of confidential documents, including private and draft ones, which may lead to data confidentiality breach and loss of trust.

Recommendation

It is recommended to immediately update the Document Embedder plugin to version 2.3.1 or later, which includes the security fix.

Other vulnerabilities in Document Embedder WordPress plugin

CVE-2026-109370Medium
The Document Embedder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'content (post_content containing block JSON documentSource.doc)' parameter in versions up to and including 2.4.0 due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts that execute when a user visits the injected page. The payload is triggered specifically when the victim clicks the embedded document's Download button, which causes the de_track_download AJAX fallback path to programmatically create an anchor with the attacker-controlled href and call .click() — a condition reached because supplying docId=0 causes can_read_document() to return false, bypassing the normal download flow.

Original NVD description (English source)

The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by enumerating IDs.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS