The vulnerability allows an unauthenticated web attacker to create, read, update, and delete document_library posts, effectively enabling arbitrary file manipulation within the WordPress site. This can lead to loss or corruption of critical documents, unauthorized disclosure of sensitive user‑generated content, and potentially broader compromise if these documents are misused.

The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is affected, including all released versions up to and including 2.0.0. The issue is specific to the plugin’s backend functions bplde_save_document_library, bplde_get_all, bplde_get_single, and bplde_delete_document_library.

Based on the description, the likely attack vector is an unauthenticated web attacker sending crafted HTTP requests to the plugin’s action hooks. With a CVSS score of 8.6 the flaw is classified as a high‑severity vulnerability. The EPSS score of less than 1% indicates that, at the time of analysis, it is considered unlikely to be actively exploited, and it is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending crafted HTTP requests to the plugin’s action hooks, bypassing authentication checks and manipulating document assets without any additional prerequisites.