CVE-2024-1803: EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Insufficient Authorization Checks to Block Usual
The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to unauthorized access of functionality due to insufficient authorization validation on the PDF embed block in all versions up to, and including, 3.9.12. This makes it possible for authenticated attackers, with contributor-level access and above, to embed PDF blocks.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1803?
CVE-2024-1803 has a medium severity level due to its potential for unauthorized access.
How do I fix CVE-2024-1803?
To fix CVE-2024-1803, update the EmbedPress plugin to the latest version beyond 3.9.12.
What types of attacks can CVE-2024-1803 be used for?
CVE-2024-1803 can be exploited for unauthorized access to PDF documents embedded in WordPress sites.
Which versions of EmbedPress are affected by CVE-2024-1803?
CVE-2024-1803 affects all versions of EmbedPress up to and including 3.9.12.
Who is responsible for the vulnerability CVE-2024-1803?
The vulnerability CVE-2024-1803 was identified in the EmbedPress plugin developed by WPDeveloper.