CVE-2026-16567: Document Embedder < 2.3.1 - Unauthenticated Private Document Download via Token Oracle
The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by enumerating IDs.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using the Document Embedder WordPress plugin at a version earlier than 2.3.1 are exposed. Documents that are private or in draft status may be accessible.
What does an attacker need to exploit it?
An attacker does not need to authenticate. They can enumerate document IDs to obtain download tokens and retrieve Document Embedder documents.
Are private and draft documents affected?
Yes. The plugin does not check document status before issuing a download token and streaming the file, so private and draft documents can be downloaded.
How can I tell whether my site may be affected?
Check whether the installed Document Embedder plugin version is earlier than 2.3.1. If it is, documents managed by the plugin may be vulnerable to unauthenticated download through ID enumeration.