CVE-2026-16567

The Document Embedder WordPress plugin versions before 2.3.1 contain an unauthenticated information disclosure vulnerability. The plugin does not verify a document's status (e.g., private, draft, published) before issuing a download token and streaming the file. An unauthenticated attacker can en...