CVE-2026-1389: 
WordPress vulnerability analysis and mitigation

CVE-2026-1389 is an Insecure Direct Object Reference (IDOR) vulnerability in the Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress, developed by bPlugins. It affects all versions up to and including 2.0.4, allowing authenticated attackers with Author-level access or above to read, modify, and delete Document Library entries belonging to other users, including administrators. The vulnerability was published on January 28, 2026, and assigned by Wordfence. It carries a CVSS v3.1 base score of 4.3 (Medium) (Feedly, Wordfence).

The root cause is an Authorization Bypass Through User-Controlled Key (CWE-639): the plugin fails to verify that the requesting user has permission to access or modify the resource identified by the id parameter in three AJAX actions — bplde_save_document_library, bplde_get_single, and bplde_delete_document_library. An authenticated attacker can supply an arbitrary document id value in these AJAX requests to access or manipulate entries created by other users. The vulnerable code paths are visible in the plugin source at includes/DocumentLibrary/Init-DocumentLibrary.php (lines 66, 103, and 159 in version 2.0.3) (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated attacker (Author-level or higher) to read, modify, or delete Document Library entries created by any user on the WordPress site, including administrators. This primarily affects data integrity and availability of managed documents (PDFs, Word files, Excel files, etc.), with limited confidentiality impact since document metadata and library entries may be exposed. The scope is limited to the WordPress instance running the vulnerable plugin, with no direct path to remote code execution or lateral movement based on available information (Feedly, Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-1389. The EPSS score is approximately 0.03%, indicating a very low probability of exploitation in the near term. The vulnerability requires authentication (Author-level or above), which further limits the attack surface. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, Wordfence).

1. Authenticate: Log in to the target WordPress site with an account that has Author-level access or higher.
2. Identify target document IDs: Use the bplde_get_single AJAX action with sequential or guessed id parameter values to enumerate Document Library entries created by other users (including administrators).
3. Read entries: Send an authenticated AJAX POST request to wp-admin/admin-ajax.php with action=bplde_get_single&id=<target_id> to retrieve document library metadata belonging to another user.
4. Modify entries: Send an authenticated AJAX POST request with action=bplde_save_document_library&id=<target_id> and modified data fields to overwrite another user's document library entry.
5. Delete entries: Send an authenticated AJAX POST request with action=bplde_delete_document_library&id=<target_id> to permanently remove a document library entry created by another user, including administrators (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing repeated authenticated POST requests to wp-admin/admin-ajax.php with action parameters of bplde_get_single, bplde_save_document_library, or bplde_delete_document_library from a single low-privileged user account, especially with varying id values.
• Application Behavior: Unexpected deletion or modification of Document Library entries, particularly those owned by administrator accounts, without corresponding admin activity in audit logs.
• Database: Unusual changes to document library records in the WordPress database (wp_posts or custom plugin tables) attributed to Author-level user IDs.

Users should update the Document Embedder plugin to version 2.0.5 or later, which introduces proper authorization checks in the affected AJAX actions. The fix is visible in the updated plugin source at includes/DocumentLibrary/Init-DocumentLibrary.php in the 2.0.5 tag. No configuration-based workaround is available; upgrading is the only recommended remediation (WordPress Trac, Wordfence).

Wordfence included CVE-2026-1389 in their weekly WordPress vulnerability report for January 26 – February 1, 2026, as part of routine disclosure coverage. Spanish national cybersecurity agencies INCIBE-CERT and CCN-CERT also published alerts for this vulnerability. No significant researcher commentary or broader media coverage has been identified beyond standard vulnerability aggregation (Wordfence Blog, INCIBE-CERT).