CVE-2025-12384highCWE-862

CVE-2025-12384: falha de alta gravidade em bplugins Document Embedder – Embed PDFs, Word…

Document Embedder – Embed PDFs, Word, Excel, and Other Files <= 2.0.0 - Missing Authorization to Unauthenticated Document Manipulation

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Document Embedder – Embed PDFs, Word, Excel, and Other Files

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.6epss 0.3%
The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to unauthorized access/modification/loss of data in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action in the "bplde_save_document_library", "bplde_get_all", "bplde_get_single", and "bplde_delete_document_library" functions. This makes it possible for unauthenticated attackers to create, read, update, and delete arbitrary document_library posts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Produtos afetados
bplugins · Document Embedder – Embed PDFs, Word, Excel, and Other Files
CVEs relacionadas — bplugins Document Embedder – Embed PDFs, Word…

No mesmo produto, das mais perigosas para as menos.

CVE-2026-1389MEDIUMDocument Embedder <= 2.0.4 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Document Library Entry DeletionEPSS 0.2%