CVE-2026-16567— Document Embedder < 2.3.1 - Unauthenticated Private Document Download via Token Oracle
Quick assessment
Affected
Unknown Document Embedder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 2.3.1 版本之前的 Document Embedder WordPress 插件在颁发下载令牌并流式传输文件时，未检查文档的状态。这允许未经身份验证的攻击者通过枚举 ID 下载任意 Document Embedder 文档，包括私有文档和草稿文档。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1210 · Exploitation of Remote ServicesAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Document Embedder | < 2.3.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-16567
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Document Embedder < 2.3.1 - Unauthenticated Private Document Download via Token Oracle
Source: CVE Program / CVE List V5
Vulnerability Description
The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by enumerating IDs.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Document Embedder | 0 ~ 2.3.1 | - |
|
II. Public POCs for CVE-2026-16567
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16567
请登录查看更多情报信息。
Proof of Concept for CVE-2026-16567 (1)
-
🔗 Document Embedder < 2.3.1 – Unauthenticated Private Document Download via Token Oracle | CVE 2026-16567 | Plugin Vulnerabilities exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-08-27 · 20 CVEs total
| CVE-2026-19092 | 9.8 CRITICAL | Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Templa |
| CVE-2026-77018 | Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Upload via Candidate P | |
| CVE-2026-78333 | 12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored XSS via Geocode Event Log | |
| CVE-2026-78138 | Finale Lite < 2.21.0 - Subscriber+ Campaign Configuration Disclosure via wcct_quick_view_h | |
| CVE-2026-78139 | Notifima < 3.1.4 - Subscriber+ Stock Alert Unsubscription via IDOR | |
| CVE-2026-78137 | StoreGrowth: Smart Sales Booster for WooCommerce < 2.1.2 - Unauthenticated Arbitrary Price | |
| CVE-2026-76549 | UpdraftPlus < 1.26.7 - Backup Restoration via CSRF | |
| CVE-2026-78125 | LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure | |
| CVE-2026-77017 | Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Read via Candidate Pro | |
| CVE-2026-77016 | Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Deletion via Candidate | |
| CVE-2026-13414 | CMP - Coming Soon & Maintenance < 4.1.18 - Unauthenticated Maintenance Mode Disable via cm | |
| CVE-2026-19225 | Defender Security < 6.2.0 - Admin+ Network-Wide RCE via Hub Connector on Multisite | |
| CVE-2026-19454 | JetBackup 3.1.18.8 - 3.1.23.3 - Admin+ Multisite Network Backup Download | |
| CVE-2026-19715 | WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug L | |
| CVE-2026-19223 | Smush < 4.3.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite | |
| CVE-2026-13415 | CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Privilege Escalation via cmp_ajax_impor | |
| CVE-2026-13416 | CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Stored XSS via niteoCS_socialmedia | |
| CVE-2026-16569 | ShopApper <= 0.4.62 - Subscriber+ Arbitrary Product Stock Update | |
| CVE-2026-16568 | ShopApper <= 0.4.62 - Subscriber+ Customer Data Disclosure via IDOR |
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-107791
WP Comment Cleaner 6.1 - 7.1 - Subscriber+ Bulk Comment Dele -
CVE-2025-15703
WP Job Openings < 4.0.0 - Admin+ Stored XSS -
CVE-2026-84166
Hotel Booking <= 3.8 - Booking Order Creation, Deletion, and -
CVE-2026-84167
Hotel Booking <= 3.8 - Subscriber+ Booking Order PII Disclos -
CVE-2026-97183
WP-Invoice <= 4.3.1 - Subscriber+ User PII Disclosure via Un
V. Comments for CVE-2026-16567
No comments yet