CVE-2021-24868
MEDIUMDocument Embedder <1.7.9 - Info Disclosure
Title source: llmDescription
The Document Embedder WordPress plugin before 1.7.9 contains a AJAX action endpoint, which could allow any authenticated user, such as subscriber to enumerate the title of arbitrary private and draft posts.
Scores
CVSS v3
4.3
EPSS
0.0027
EPSS Percentile
50.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Classification
CWE
CWE-668
Status
published
Affected Products (1)
bplugins/document_embedder
< 1.7.9
Timeline
Published
Feb 01, 2022
Tracked Since
Feb 18, 2026