CVE-2026-1389: Document Embedder IDOR Vulnerability

CVE-2026-1389 Overview

The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in all versions up to and including 2.0.4. The vulnerability stems from the plugin's failure to verify that a user has permission to access the requested resource in multiple AJAX actions: bplde_save_document_library, bplde_get_single, and bplde_delete_document_library. This security flaw enables authenticated attackers with Author-level access or higher to read, modify, and delete Document Library entries created by other users—including administrators—by manipulating the id parameter.

Critical Impact

Authenticated attackers with Author-level privileges can access, modify, and delete Document Library entries belonging to other users, including administrators, leading to potential data breach and content manipulation.

Affected Products

• Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress versions up to and including 2.0.4

Discovery Timeline

• 2026-01-28 - CVE CVE-2026-1389 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-1389

Vulnerability Analysis

This Insecure Direct Object Reference (IDOR) vulnerability classified under CWE-639 (Authorization Bypass Through User-Controlled Key) affects critical document management functionality within the WordPress plugin. The vulnerability allows authenticated users with minimal privileges (Author-level) to bypass authorization controls and access resources belonging to other users.

The flaw exists in three distinct AJAX action handlers within the Init-DocumentLibrary.php file. Each of these handlers accepts an id parameter from user input but fails to validate whether the requesting user has ownership or appropriate permissions to access the referenced Document Library entry. This allows horizontal privilege escalation, where an attacker can access data belonging to users at the same or higher privilege level.

Root Cause

The root cause is a missing authorization check in the AJAX handlers. The plugin verifies that the user is authenticated but does not verify that the authenticated user has permission to access or modify the specific Document Library entry identified by the id parameter. This is a classic IDOR pattern where user-supplied input directly references internal objects without proper access control validation.

The vulnerable code paths are located in:

• Init-DocumentLibrary.php at line 66 (bplde_save_document_library)
• Init-DocumentLibrary.php at line 103 (bplde_get_single)
• Init-DocumentLibrary.php at line 159 (bplde_delete_document_library)

Attack Vector

The attack is network-based and requires the attacker to have a valid WordPress account with Author-level privileges or higher. Once authenticated, the attacker can enumerate or guess valid document library entry IDs and submit crafted AJAX requests to the vulnerable endpoints.

For the bplde_get_single action, an attacker can retrieve sensitive document information belonging to other users by supplying the target entry's ID. Using bplde_save_document_library, the attacker can modify entries they do not own. The bplde_delete_document_library action allows deletion of arbitrary Document Library entries, potentially causing data loss or disruption of legitimate content.

The attack requires low complexity—the attacker simply needs to modify the id parameter in legitimate AJAX requests to reference entries belonging to other users.

Detection Methods for CVE-2026-1389

Indicators of Compromise

• Unexpected AJAX requests to bplde_get_single, bplde_save_document_library, or bplde_delete_document_library actions with sequential or enumerated id parameters
• WordPress audit logs showing Author-level users accessing or modifying Document Library entries they did not create
• Unusual patterns of document library deletions or modifications attributed to non-administrative accounts
• Web server access logs containing repeated requests to admin-ajax.php with the vulnerable action names

Detection Strategies

• Implement WordPress activity logging plugins to monitor AJAX action usage by user role
• Configure web application firewall (WAF) rules to detect rapid enumeration of the id parameter in Document Embedder AJAX requests
• Review WordPress audit trails for Author-level accounts accessing administrative document entries
• Monitor for anomalous patterns in document library operations that don't match normal user behavior

Monitoring Recommendations

• Enable comprehensive WordPress audit logging that captures AJAX requests with user context
• Set up alerts for bulk document library operations performed by non-administrative users
• Regularly review access patterns to sensitive document library entries
• Implement rate limiting on AJAX endpoints to detect and prevent automated enumeration attacks

How to Mitigate CVE-2026-1389

Immediate Actions Required

• Update the Document Embedder plugin to version 2.0.5 or later immediately
• Audit Document Library entries for unauthorized modifications or deletions
• Review WordPress user accounts with Author-level access for suspicious activity
• Consider temporarily disabling the plugin if an immediate update is not possible

Patch Information

The vulnerability has been addressed in version 2.0.5 of the Document Embedder plugin. The fix implements proper authorization checks in the affected AJAX handlers to verify that users can only access, modify, or delete Document Library entries they have permission to manage. The patched code can be reviewed at the WordPress Plugin Version 2.0.5 repository.

Additional technical details and vulnerability analysis are available from the Wordfence Vulnerability Analysis.

Workarounds

• Disable the Document Embedder plugin until the update can be applied
• Restrict Author-level and Contributor-level account creation to trusted individuals only
• Implement a web application firewall rule to block or monitor requests to the affected AJAX actions
• Use WordPress security plugins to add additional authorization layers to AJAX requests

# Configuration example: Temporarily block vulnerable AJAX actions via .htaccess
# Add to WordPress .htaccess file to block vulnerable endpoints
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} admin-ajax\.php
RewriteCond %{QUERY_STRING} action=(bplde_save_document_library|bplde_get_single|bplde_delete_document_library)
RewriteRule .* - [F,L]
</IfModule>