Document Embedder – Embed Pdfs, Word, Excel, And Other Files
Approved changes feed: RSS · Atom
cpe:2.3:a:bplugins:document_embedder_–_embed_pdfs,_word,_excel,_and_other_files:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Bplugins (d23d5d08-ee04-5724-85c5-d147aa9863c7) |
|---|---|
| Product | Document Embedder – Embed Pdfs, Word, Excel, And Other Files (723b77d8-5f4a-5bf9-ac64-63677feab295) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-1389 |
vulnerable | 2026-06-08 07:49:08.476589 |
Document Embedder <= 2.0.4 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Document Library Entry Deletion
MEDIUM (4.3)
The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.4. This is due to the plugin not verifying that a user has permission to access the requested resource in the 'bplde_save_document_library', 'bplde_get_single', and 'bplde_delete_document_library' AJAX actions. This makes it possible for authenticated attackers, with Author-level access and above, to read, modify, and delete Document Library entries created by other users, including administrators, via the 'id' parameter.
Published: 2026-01-28T07:27:34.729Z
Updated: 2026-04-08T16:54:55.705Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-12384 |
vulnerable | 2026-06-08 07:04:30.144235 |
Document Embedder – Embed PDFs, Word, Excel, and Other Files <= 2.0.0 - Missing Authorization to Unauthenticated Document Manipulation
HIGH (8.6)
The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to unauthorized access/modification/loss of data in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action in the "bplde_save_document_library", "bplde_get_all", "bplde_get_single", and "bplde_delete_document_library" functions. This makes it possible for unauthenticated attackers to create, read, update, and delete arbitrary document_library posts.
Published: 2025-11-05T06:35:02.300Z
Updated: 2026-04-08T17:31:13.437Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.