Vulnerability · Published Nov 5, 2025 · Assigned by Wordfence
CVE-2025-12384Document Embedder – Embed PDFs, Word, Excel, and Other Files <= 2.0.0 - Missing Authorization to Unauthenticated Document Manipulation
High 8.6
In plain English
A high-severity missing authorization in Document Embedder – Embed PDFs, Word, Excel, and Other Files from bplugins. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Official description
The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to unauthorized access/modification/loss of data in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action in the "bplde_save_document_library", "bplde_get_all", "bplde_get_single", and "bplde_delete_document_library" functions. This makes it possible for unauthenticated attackers to create, read, update, and delete arbitrary document_library posts.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| bplugins | Document Embedder – Embed PDFs, Word, Excel, and Other Files | 0 – through 2.0.0 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/eb7e4e96-a4ff-4c6c-91de-c0e5ba78f0da?source=cve
- https://plugins.trac.wordpress.org/changeset?old=3359820&old_path=document-emberdder%2Ftrunk%2Fincludes%2FDocumentLibrary%2FInit-DocumentLibrary.php&new=&new_path=document-emberdder%2Ftrunk%2Fincludes%2FDocumentLibrary%2FInit-DocumentLibrary.php
- https://plugins.trac.wordpress.org/changeset?old=3359820&old_path=document-emberdder%2Ftrunk%2Fdocument-library-block.php&new=&new_path=document-emberdder%2Ftrunk%2Fdocument-library-block.php