CVE-2025-12384

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12384", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-28T11:35:02.879Z", "datePublished": "2025-11-05T06:35:02.300Z", "dateUpdated": "2026-04-08T17:31:13.437Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:31:13.437Z"}, "affected": [{"vendor": "bplugins", "product": "Document Embedder \u2013 Embed PDFs, Word, Excel, and Other Files", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Document Embedder \u2013 Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to unauthorized access/modification/loss of data in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action in the \"bplde_save_document_library\", \"bplde_get_all\", \"bplde_get_single\", and \"bplde_delete_document_library\" functions. This makes it possible for unauthenticated attackers to create, read, update, and delete arbitrary document_library posts."}], "title": "Document Embedder \u2013 Embed PDFs, Word, Excel, and Other Files <= 2.0.0 - Missing Authorization to Unauthenticated Document Manipulation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eb7e4e96-a4ff-4c6c-91de-c0e5ba78f0da?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?old=3359820&old_path=document-emberdder%2Ftrunk%2Fincludes%2FDocumentLibrary%2FInit-DocumentLibrary.php&new=&new_path=document-emberdder%2Ftrunk%2Fincludes%2FDocumentLibrary%2FInit-DocumentLibrary.php"}, {"url": "https://plugins.trac.wordpress.org/changeset?old=3359820&old_path=document-emberdder%2Ftrunk%2Fdocument-library-block.php&new=&new_path=document-emberdder%2Ftrunk%2Fdocument-library-block.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "baseScore": 8.6, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "NumeX"}], "timeline": [{"time": "2025-10-16T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-10-28T11:53:00.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-04T17:38:20.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-05T14:22:25.201758Z", "id": "CVE-2025-12384", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-05T14:22:37.337Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12384", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-05T14:22:25.201758Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-05T14:22:28.695Z"}}], "cna": {"title": "Document Embedder \u2013 Embed PDFs, Word, Excel, and Other Files <= 2.0.0 - Missing Authorization to Unauthenticated Document Manipulation", "credits": [{"lang": "en", "type": "finder", "value": "NumeX"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L"}}], "affected": [{"vendor": "bplugins", "product": "Document Embedder \u2013 Embed PDFs, Word, Excel, and Other Files", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.0.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-16T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-10-28T11:53:00.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-04T17:38:20.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eb7e4e96-a4ff-4c6c-91de-c0e5ba78f0da?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?old=3359820&old_path=document-emberdder%2Ftrunk%2Fincludes%2FDocumentLibrary%2FInit-DocumentLibrary.php&new=&new_path=document-emberdder%2Ftrunk%2Fincludes%2FDocumentLibrary%2FInit-DocumentLibrary.php"}, {"url": "https://plugins.trac.wordpress.org/changeset?old=3359820&old_path=document-emberdder%2Ftrunk%2Fdocument-library-block.php&new=&new_path=document-emberdder%2Ftrunk%2Fdocument-library-block.php"}], "descriptions": [{"lang": "en", "value": "The Document Embedder \u2013 Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to unauthorized access/modification/loss of data in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action in the \"bplde_save_document_library\", \"bplde_get_all\", \"bplde_get_single\", and \"bplde_delete_document_library\" functions. This makes it possible for unauthenticated attackers to create, read, update, and delete arbitrary document_library posts."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:31:13.437Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12384", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:31:13.437Z", "dateReserved": "2025-10-28T11:35:02.879Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-05T06:35:02.300Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Document Embedder \u2013 Embed PDFs, Word, Excel, and Other Files", "vendor": "bplugins", "versions": [{"lessThanOrEqual": "2.0.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Document Embedder \u2013 Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to unauthorized access/modification/loss of data in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action in the \"bplde_save_document_library\", \"bplde_get_all\", \"bplde_get_single\", and \"bplde_delete_document_library\" functions. This makes it possible for unauthenticated attackers to create, read, update, and delete arbitrary document_library posts."}, {"lang": "es", "value": "El plugin Document Embedder - Embed PDFs, Word, Excel, and Other Files para WordPress es vulnerable a acceso/modificaci\u00f3n/p\u00e9rdida de datos no autorizados en todas las versiones hasta la 2.0.0, inclusive. Esto se debe a que el plugin no verifica adecuadamente que un usuario est\u00e1 autorizado para realizar una acci\u00f3n en las funciones \u201cbplde_save_document_library\u201d, \u201cbplde_get_all\u201d, \u201cbplde_get_single\u201d y \u201cbplde_delete_document_library\u201d. Esto hace posible que atacantes no autenticados creen, lean, actualicen y eliminen publicaciones arbitrarias de tipo document_library."}], "id": "CVE-2025-12384", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12384", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-05T14:22:25.201758Z", "version": "2.0.3"}}]}, "published": "2025-11-05T07:15:32.570", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?old=3359820&old_path=document-emberdder%2Ftrunk%2Fdocument-library-block.php&new=&new_path=document-emberdder%2Ftrunk%2Fdocument-library-block.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?old=3359820&old_path=document-emberdder%2Ftrunk%2Fincludes%2FDocumentLibrary%2FInit-DocumentLibrary.php&new=&new_path=document-emberdder%2Ftrunk%2Fincludes%2FDocumentLibrary%2FInit-DocumentLibrary.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eb7e4e96-a4ff-4c6c-91de-c0e5ba78f0da?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T18:38:17.363045+00:00", "value": {"mitigation_remediation": ["Upgrade the Document Embedder plugin to a version newer than 2.0.0, which removes the missing authorization checks.", "If an upgrade is not immediately possible, disable the plugin entirely to block unauthenticated access to the vulnerable functions.", "Ensure that only users with administrator roles have capability to access document manipulation features by reviewing WordPress role settings and removing any default editor or subscriber permissions that may have been granted to the plugin."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Document Manipulation"}, "threat_synthesis": {"affected_systems": "The Document Embedder \u2013 Embed PDFs, Word, Excel, and Other Files plugin for WordPress is affected, including all released versions up to and including 2.0.0. The issue is specific to the plugin\u2019s backend functions bplde_save_document_library, bplde_get_all, bplde_get_single, and bplde_delete_document_library.", "description_and_impact": "The vulnerability allows an unauthenticated web attacker to create, read, update, and delete document_library posts, effectively enabling arbitrary file manipulation within the WordPress site. This can lead to loss or corruption of critical documents, unauthorized disclosure of sensitive user\u2011generated content, and potentially broader compromise if these documents are misused.", "risk_and_exploitability": "Based on the description, the likely attack vector is an unauthenticated web attacker sending crafted HTTP requests to the plugin\u2019s action hooks. With a CVSS score of 8.6 the flaw is classified as a high\u2011severity vulnerability. The EPSS score of less than 1% indicates that, at the time of analysis, it is considered unlikely to be actively exploited, and it is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending crafted HTTP requests to the plugin\u2019s action hooks, bypassing authentication checks and manipulating document assets without any additional prerequisites."}}}}, "created": "2025-11-06T10:07:26.615812+00:00", "updated": "2026-04-21T18:45:06.079592+00:00", "vendors": ["bplugins", "bplugins$PRODUCT$document_embedder", "wordpress", "wordpress$PRODUCT$wordpress"]}