Description
The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.5 via the 'embeddoc' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Published: 2025-02-20
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Server‑Side Request Forgery
Action: Update Plugin
AI Analysis

Impact

The vulnerability is a server‑side request forgery (SSRF) that allows an authenticated user with Contributor or higher privileges to trigger outbound HTTP requests from the WordPress site by using the 'embeddoc' shortcode. By supplying a crafted URL, the attacker can have the server query or modify data on arbitrary internal services. The flaw is a classic blind SSRF (CWE-918) and could be leveraged to exfiltrate data or alter configuration on backend services.

Affected Systems

All WordPress installations that have the Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin (developed by awsmin) installed, versions 2.7.5 and below.

Risk and Exploitability

The CVSS score of 6.4 indicates a fairly moderate impact, while the EPSS score of <1% suggests that exploitation is unlikely to be widespread at this time. The vulnerability is not listed in CISA's KEV catalog. Attackers would need to first gain Contributor‑level or higher access to the site and then insert a malicious shortcode to induce outbound requests, potentially exposing or manipulating internal resources.

Generated by OpenCVE AI on April 20, 2026 at 23:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Embed Any Document plugin to a version newer than 2.7.5 as soon as a fix is released.
  • If an upgrade is not yet available, disable the 'embeddoc' shortcode or remove the plugin, and revoke Contributor or higher roles from users who do not require them.
  • Apply firewall rules or network segmentation to prevent the WordPress server from accessing internal IP ranges, limiting the impact of any remaining SSRF.
  • Monitor application logs for unexpected outbound HTTP requests and audit access privileges for abuse.

Generated by OpenCVE AI on April 20, 2026 at 23:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-4610 The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.5 via the 'embeddoc' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
History

Thu, 20 Feb 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Feb 2025 11:30:00 +0000

Type Values Removed Values Added
Description The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.5 via the 'embeddoc' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Title Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files <= 2.7.5 - Authenticated (Contributor+) Blind Server-Side Request Forgery via embeddoc Shortcode
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:18:10.534Z

Reserved: 2025-02-04T20:45:04.541Z

Link: CVE-2025-1043

cve-icon Vulnrichment

Updated: 2025-02-20T14:17:48.580Z

cve-icon NVD

Status : Deferred

Published: 2025-02-20T12:15:11.030

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-1043

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-21T00:00:13Z

Weaknesses