5.3
Moyenne
CVE-2026-16567 The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download…
Description
The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by enumerating IDs.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Document Embedder 2.3 | premières → < 2.3.1 | 2.3.1 |