CVE-2026-7526 affects PDF Embedder and is an authenticated Contributor+ information exposure vulnerability in versions up to and including 4.9.3. Loading the WordPress block editor places scalar values from the site-wide pdfemb option set into the global pdfembPluginOptions JavaScript object without a capability check or allowlist. Low-privileged users can read viewer configuration, and a saved premium license key can be disclosed when the premium add-on is installed.
| CVE | CVE-2026-7526 |
| Plugin Version | PDF Embedder <= 4.9.3, fixed in 5.0.0 |
| All Time | 5 558 783 |
| Active installations | 300 000+ |
| Publicly Published | May 27, 2026 |
| Last Updated | May 28, 2026 |
| Researcher | Dmitrii Ignatyev |
| PoC | Yes |
| Exploit | No |
| Reference | https://www.cve.org/CVERecord?id=CVE-2026-7526 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/pdf-embedder/pdf-embedder-493-authenticated-contributor-information-exposure-via-block-editor-page |
| Plugin Security Certification by CleanTalk |  |
| Logo of the plugin |  |
PSC by CleantalkJoin the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.
Timeline
| April 8, 2026 | Plugin testing and vulnerability detection in PDF Embedder were completed. |
| April 8, 2026 | The vulnerability was reported with PoC, description, and recommendations for remediation. |
| May 27, 2026 | CVE-2026-7526 was publicly published by Wordfence. |
Discovery of the Vulnerability
The vulnerable path runs through enqueue_block_assets when wp-admin/post-new.php loads. PDF Embedder calls pdf_embedder()->options()->get(), iterates through the returned pdfemb options, copies every scalar value, and removes the pdfemb_ prefix before preparing the data for its block editor script.
The plugin localizes the complete result as pdfembPluginOptions before the editor script runs. It does not restrict the array to values required by the block interface and does not verify an administrative capability. The disclosure occurs even when the user never inserts the PDF Embedder block. On a network-activated multisite installation, the same behavior can expose shared configuration to low-privileged users on individual sites.
Understanding of Information Exposure attacks
Information exposure occurs when data crosses an authorization boundary through a response, page source, or localized JavaScript object. The edit_posts capability allows Contributors to create content, but it does not authorize them to read administrator-managed plugin configuration.
The impact depends on the scalar values stored in pdfemb. Lite-only installations normally expose viewer settings such as dimensions, toolbar behavior, usage tracking, and plan data. When the premium add-on has stored a license key, the same unrestricted export can make that value available as pdfembPluginOptions.license_key.
Exploiting the Information Exposure Vulnerability
The following non-destructive PoC reads the JavaScript object already exposed on the post creation screen. It does not insert a block or modify plugin configuration.
POC:
POC: 1. Log in to WordPress as a Contributor. 2. Open /wp-admin/post-new.php. 3. Open the browser developer console. 4. Run pdfembPluginOptions.license_key. 5. If the premium add-on has stored a key, observe the returned value.____
On a Lite-only installation, license_key may be absent. Other scalar settings remain available through pdfembPluginOptions to any authenticated user who can open the block editor.
Recommendations for Improved Security
Site owners should update PDF Embedder to version 5.0.0 or later. Administrators using the premium add-on should rotate a license key if untrusted Contributor-level accounts could access the editor while a key was stored. Multisite operators should also review whether shared plugin settings were exposed to individual site users.
Developers should apply a strict allowlist to configuration passed into editor JavaScript and exclude license or administrative values entirely. Any remaining sensitive data should be localized only on the required screen after an appropriate current_user_can() check. Access to post editing must not be treated as permission to read site-wide plugin settings.
By addressing Information Exposure issues like CVE-2026-7526, WordPress site owners can keep administrative plugin settings out of low-privileged editor sessions. Stay vigilant, stay secure.
#WordPressSecurity #InformationExposure #MissingAuthorization #PluginSecurity #WebsiteSafety #StayProtected #MediumVulnerability
Use CleanTalk solutions to improve the security of your website
