Executive brief
The PDF Embedder plugin for WordPress, which allows users to display PDF files directly on their websites, contains a security flaw that exposes configuration data. An attacker with basic contributor-level access to the site can view internal settings and, if the premium version is used, potentially steal the product license key. This could lead to unauthorized use of paid software features or exposure of site configuration details.
Technical details
The PDF Embedder plugin for WordPress is vulnerable to Sensitive Information Exposure (CWE-200) via the 'enqueue_block_assets' function. The vulnerability exists in all versions up to and including 4.9.3. An authenticated attacker with contributor-level permissions or higher can exploit this to extract configuration data. In installations where the premium add-on is active, this includes the exposure of the license key. In the Lite version, the exposure is limited to viewer configuration values such as dimensions, toolbar settings, and usage tracking. A patch has been released in the plugin's trunk.
Affected products
- WP PDF Embedder PDF Embedder Up to and including 4.9.3
Timeline
- 2026-05-28: disclosed
- 2026-05-28: advisory
References
- https://plugins.trac.wordpress.org/browser/pdf-embedder/tags/4.9.3/src/Plugin.php
- https://plugins.trac.wordpress.org/browser/pdf-embedder/tags/4.9.3/src/Plugin.php
- https://plugins.trac.wordpress.org/browser/pdf-embedder/trunk/src/Plugin.php
- https://plugins.trac.wordpress.org/browser/pdf-embedder/trunk/src/Plugin.php
- https://plugins.trac.wordpress.org/changeset/3531901/pdf-embedder/trunk/src/Plugin.php?old=3429550&old_path=pdf-embedder%2Ftrunk%2Fsrc%2FPlugin.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0e0f2516-0fa7-415e-868e-6bd259bc6546?source=cve