Threats tagged 'ghsa-r4m2-c49p-wch4'

The Document Embedder WordPress plugin before version 2.3.1 allows unauthenticated attackers to download arbitrary documents, including private and draft ones, by enumerating document IDs. This occurs because the plugin does not verify a document's status before issuing a download token and streaming the file.