Security Alert Summary
The PDF Embedder plugin for WordPress contains a sensitive information exposure vulnerability (CVE-2026-7526) that affects all versions up to and including 4.9.3. Authenticated users with contributor-level access or higher can extract plugin configuration data via the plugin’s block asset enqueueing, and a stored license key may be exposed when the premium add-on is installed.
CVE Details
- CVE ID: CVE-2026-7526
- Affected component: PDF Embedder plugin for WordPress
- Affected versions: All versions up to and including 4.9.3
- Published: May 28, 2026 9:16 AM UTC
- Last modified: May 28, 2026 1:45 PM UTC
- CVSS v3.1: Base score 4.3,
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N(MEDIUM) - Authentication / privileges / interaction: Requires authenticated access; privileges required: LOW (contributor-level access or higher); user interaction: NONE
- Primary impact: Confidentiality: LOW; Integrity: NONE; Availability: NONE
- CWE: CWE-200 (Exposure of Sensitive Information)
Technical Details
According to the advisory, the vulnerability occurs via the plugin’s enqueue_block_assets functionality. When block assets are enqueued, authenticated users with contributor-level access or higher can access configuration data that the plugin exposes. This allows extraction of stored configuration values.
The description specifies that, on installations with the premium add-on present and a saved license key, the exposed data may include the license key itself. On installations using the Lite version only, the exposed data is limited to non-sensitive viewer configuration values such as width, height, toolbar settings, usage tracking, and plan.
The issue exists because the asset enqueueing path exposes configuration data to users who can trigger or access those assets without adequate authorization checks. The impact is information disclosure scoped to the configuration and, in some setups, a stored license key.
How This Could Impact Your Website
In a typical WordPress environment you might have a site owner or administrator, internal staff who publish or edit content, and external contributors or contractors with contributor-level accounts. If a contributor-level account can extract plugin configuration and, in some cases, a stored license key, an attacker could:
- Obtain plugin settings that reveal usage tracking or plan information.
- Retrieve a stored license key when the premium add-on is installed, which could be used to target account recovery or licensing support channels.
- Use configuration details to aid targeted phishing or social engineering against staff or contractors, increasing the risk that internal user emails or other sensitive data are exposed through secondary actions.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior related to plugin configuration access.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/pdf-embedder/tags/4.9.3/src/Plugin.php#L204
- https://plugins.trac.wordpress.org/browser/pdf-embedder/tags/4.9.3/src/Plugin.php#L224
- https://plugins.trac.wordpress.org/browser/pdf-embedder/trunk/src/Plugin.php#L204
- https://plugins.trac.wordpress.org/browser/pdf-embedder/trunk/src/Plugin.php#L224
- https://plugins.trac.wordpress.org/changeset/3531901/pdf-embedder/trunk/src/Plugin.php?old=3429550&old_path=pdf-embedder%2Ftrunk%2Fsrc%2FPlugin.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0e0f2516-0fa7-415e-868e-6bd259bc6546?source=cve
