CVE-2025-12384 is a missing authorization vulnerability in the Document Embedder – Embed PDFs, Word, Excel, and Other Files WordPress plugin (versions up to 2.0.0). The plugin fails to verify that users are authorized to perform actions in the functions bplde_save_document_library, bplde_get_all, bplde_get_single, and bplde_delete_document_library. This flaw enables unauthenticated attackers to perform unauthorized create, read, update, and delete operations on document_library posts, potentially leading to data loss or modification.

An attacker without authentication can manipulate document_library posts arbitrarily, resulting in unauthorized data access, modification, or deletion. This compromises the confidentiality, integrity, and availability of the affected data managed by the plugin. The CVSS score of 8.6 reflects a high impact with network attack vector, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's functionality by limiting user permissions and consider disabling the plugin if not essential. Monitor for updates from the vendor or security advisories for a patch or temporary workaround.