CVE-2026-16567: Document Embedder Information Disclosure

CVE-2026-16567 Overview

CVE-2026-16567 affects the Document Embedder WordPress plugin in versions prior to 2.3.1. The plugin fails to check a document's publication status before issuing a download token and streaming the file. Unauthenticated attackers can enumerate document IDs and retrieve arbitrary documents, including private and draft content. The flaw is a broken access control issue that exposes non-public files stored through the plugin to any anonymous visitor.

Critical Impact

Unauthenticated attackers can download private and draft documents from vulnerable WordPress sites by enumerating internal document IDs.

Affected Products

• Document Embedder WordPress plugin versions prior to 2.3.1

Discovery Timeline

• 2026-08-27 - CVE-2026-16567 published to NVD
• 2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-16567

Vulnerability Analysis

The Document Embedder plugin generates download tokens and streams file content when a document ID is requested. The download handler does not validate the document's status before issuing that token. Draft and private documents are treated identically to published ones during the download flow. As a result, any unauthenticated user who supplies a valid numeric ID receives the associated file. The flaw represents a Broken Access Control issue and an Insecure Direct Object Reference against restricted resources.

Root Cause

The root cause is a missing authorization check on the document status field within the download endpoint. The plugin issues a signed or time-bound download token based solely on the existence of a document record. It does not verify that the document is published, that the requester holds a matching capability, or that the caller is authenticated for non-public items.

Attack Vector

An attacker sends unauthenticated HTTP requests to the plugin's download endpoint while iterating through sequential document IDs. Each valid ID returns a download token, which is then exchanged for the file contents streamed by the server. The attack requires no credentials, no user interaction, and no prior knowledge of document titles or slugs. Enumeration is trivial because WordPress post IDs are sequential integers.

Detection Methods for CVE-2026-16567

Indicators of Compromise

• Sequential or high-volume requests to the Document Embedder download endpoint from a single source IP address.
• Successful HTTP 200 responses returning file content for document IDs that correspond to draft or private posts.
• Anomalous outbound bandwidth from wp-content/uploads/ paths tied to the plugin's document storage directory.

Detection Strategies

• Review web server access logs for repeated requests to the plugin's document download route with incrementing ID parameters.
• Correlate download events against the WordPress post status table to flag downloads of non-published items.
• Alert on unauthenticated sessions retrieving multiple distinct document IDs within a short window.

Monitoring Recommendations

• Enable verbose logging on the WordPress reverse proxy or Web Application Firewall (WAF) for plugin-specific routes.
• Track download token issuance rates and compare against baseline traffic for the plugin.
• Monitor for user-agent strings and IP addresses associated with automated enumeration tools.

How to Mitigate CVE-2026-16567

Immediate Actions Required

• Update the Document Embedder plugin to version 2.3.1 or later on all affected WordPress installations.
• Audit stored documents to identify sensitive drafts or private files that may have been exposed prior to patching.
• Rotate or revoke any credentials, contracts, or personally identifiable information contained in downloadable documents that were previously non-public.

Patch Information

The vendor addressed the issue in Document Embedder version 2.3.1 by enforcing a document status check before issuing download tokens. Site administrators should apply the update through the WordPress plugin dashboard or by replacing the plugin directory with the fixed release. Details are available in the WPScan Vulnerability Report.

Workarounds

• Deactivate the Document Embedder plugin until the patched version can be deployed.
• Restrict access to the plugin's download endpoint at the WAF or reverse proxy layer, blocking unauthenticated requests.
• Move sensitive documents out of the plugin's managed storage until remediation is complete.

# Example WAF rule to block unauthenticated download enumeration
location ~* /wp-admin/admin-ajax.php {
    if ($arg_action = "document_embedder_download") {
        set $block_flag 1;
    }
    if ($http_cookie !~* "wordpress_logged_in") {
        set $block_flag "${block_flag}1";
    }
    if ($block_flag = "11") {
        return 403;
    }
}