CVE-2025-12384
Published: 05 November 2025
Summary
CVE-2025-12384 is a high-severity Missing Authorization (CWE-862) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-12384 affects the Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress in all versions up to and including 2.0.0. The vulnerability enables unauthorized access, modification, and loss of data due to missing authorization checks in the "bplde_save_document_library", "bplde_get_all", "bplde_get_single", and "bplde_delete_document_library" functions. This allows attackers to create, read, update, and delete arbitrary document_library posts. It is rated with a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) and is associated with CWE-862 (Missing Authorization).
Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation grants low-level confidentiality impact by reading document_library posts, high integrity impact through unauthorized creation, updates, and deletions, and low availability impact, potentially disrupting document management on affected WordPress sites.
Mitigation details are available in plugin advisories, including Wordfence threat intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/eb7e4e96-a4ff-4c6c-91de-c0e5ba78f0da?source=cve. Patches addressing the authorization checks appear in WordPress plugin trac changesets: https://plugins.trac.wordpress.org/changeset?old=3359820&old_path=document-emberdder%2Ftrunk%2Fdocument-library-block.php&new=&new_path=document-emberdder%2Ftrunk%2Fdocument-library-block.php and https://plugins.trac.wordpress.org/changeset?old=3359820&old_path=document-emberdder%2Ftrunk%2Fincludes%2FDocumentLibrary%2FInit-DocumentLibrary.php&new=&new_path=document-emberdder%2Ftrunk%2Fincludes%2FDocumentLibrary%2FInit-DocumentLibrary.php. Security practitioners should update to a patched version beyond 2.0.0 and review sites using this plugin.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-37788
Vulnerability details
The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to unauthorized access/modification/loss of data in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a…
more
user is authorized to perform an action in the "bplde_save_document_library", "bplde_get_all", "bplde_get_single", and "bplde_delete_document_library" functions. This makes it possible for unauthenticated attackers to create, read, update, and delete arbitrary document_library posts.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization in public-facing WordPress plugin functions enables unauthenticated remote CRUD on document_library posts, directly facilitating T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for logical access to information and system resources, directly mitigating the missing authorization checks in the plugin's CRUD functions for document_library posts.
Requires identification, reporting, patching, and deployment of flaw remediations, directly addressing the need to update the vulnerable plugin beyond version 2.0.0.
Employs least privilege to restrict access to only authorized capabilities, limiting the impact of unauthorized creation, reading, updating, and deletion of document_library posts.