The Document Embedder plugin for WordPress fails to validate a document’s confidentiality status before generating a download token and streaming the file. An unauthenticated attacker can craft a request that triggers the token creation, then obtain the document directly. The flaw permits disclosure of private and draft content, compromising confidentiality and potentially exposing sensitive business data. The vulnerability is a form of improper access control (CWE‑639).

The issue affects the Document Embedder WordPress plugin for all installations running any version earlier than 2.3.1. Users who have not applied the 2.3.1 update remain susceptible if the plugin is enabled and available on the site.

The EPSS score is < 1%, indicating a very low but non‑zero exploitation probability, and the flaw is not listed in the CISA KEV catalog, but the path to exploitation is straightforward: any visitor can enumerate document IDs and access the download endpoint in an unauthenticated fashion. Because the text says the vulnerability allows an unauthenticated user to download arbitrary documents, the risk is chiefly confidentiality loss. Impact depends on the sensitivity of the secrets stored in private or draft documents; if sensitive, the risk is high. The exploit does not require privileged credentials, which increases its availability and likelihood. The CVSS score of 5.3 indicates medium severity.