The plugin fails to verify user permissions when handling AJAX actions that save, fetch, or delete document library items. An attacker who is logged in with Author or higher roles can supply the 'id' parameter to read, modify, or delete any entry created by other users, including administrators. This vulnerability compromises the integrity of the document library, leading to accidental or malicious data loss, and can undermine trust in the platform. The nature of the flaw is an insecure direct object reference (CWE‑639).

Affected products include the WordPress plugin Document Embedder – Embed PDFs, Word, Excel, and Other Files. Versions up to 2.0.4 are vulnerable; version 2.0.5 and later contain the fix. Any site running the plugin in those versions is at risk. No other versions are mentioned.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with at least Author privileges, and the attacker must perform an HTTP request to the protected AJAX endpoints with a crafted 'id' parameter. Because only users who can access the plugin's UI can trigger the AJAX calls, the attack surface is limited to sites with many elevated users.