Yüksek CVSS 8.6
CVE-2025-12384: CVE-2025-12384: eksik yetkilendirme
Açıklama (NVD)
The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to unauthorized access/modification/loss of data in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action in the "bplde_save_document_library", "bplde_get_all", "bplde_get_single", and "bplde_delete_document_library" functions. This makes it possible for unauthenticated attackers to create, read, update, and delete arbitrary document_library posts.
Özet bilgiler
- CVSS v3.1
- 8.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L - EPSS
- %0,33 (yüzdelik 26)
- CWE
- CWE-862
- Yama
- Yok / bilinmiyor