Vulnerability Description
The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to unauthorized access/modification/loss of data in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action in the "bplde_save_document_library", "bplde_get_all", "bplde_get_single", and "bplde_delete_document_library" functions. This makes it possible for unauthenticated attackers to create, read, update, and delete arbitrary document_library posts.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://plugins.trac.wordpress.org/changeset?old=3359820&old_path=document-ember
- https://plugins.trac.wordpress.org/changeset?old=3359820&old_path=document-ember
- https://www.wordfence.com/threat-intel/vulnerabilities/id/eb7e4e96-a4ff-4c6c-91d
FAQ
What is CVE-2025-12384?
CVE-2025-12384 is a vulnerability with a CVSS score of 8.6 (HIGH). The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to unauthorized access/modification/loss of data in all versions up to, and including, 2.0.0. This i...
How severe is CVE-2025-12384?
CVE-2025-12384 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-12384?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.