5.3
Medium
CVE-2026-16567 The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download…
Description
The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by enumerating IDs.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Document Embedder 2.3 | earliest → < 2.3.1 | 2.3.1 |