Executive brief
The Document Embedder WordPress plugin is used to manage and embed documents for download on WordPress sites. Before version 2.3.1, the plugin fails to verify whether a document is private or draft before issuing a download token, allowing attackers to bypass access controls and download any document by guessing sequential IDs. This exposes confidential business documents, drafts, and other sensitive files that were intended to be restricted.
Technical details
The vulnerability is an insecure direct object reference (IDOR) combined with broken access control. The vulnerable component is the AJAX action `de_track_download`, which issues a download token without checking the document's post status (public/private/draft). An unauthenticated attacker can extract the tracking nonce from any public page, request a download token for an arbitrary document ID, and then access the file via the public REST endpoint `/wp-json/docembedder/v1/download/`. Since the token is bound to the requester's IP address and both requests originate from the same source, the token validates. The attack requires only a valid document ID, which can be enumerated through sequential integers. The vulnerability is fixed in version 2.3.1.
Affected products
- WordPress Document Embedder before 2.3.1
Timeline
- 2026-08-25: disclosed: Vulnerability publicly disclosed
- 2026-08-27: patched: Fixed in version 2.3.1