CVE-2025-22696 MEDIUM

CVE-2025-22696: WordPress Document Block – Upload & Embed Docs, PDF, PPT, XLS or Any Documents plugin <= 1.1.0 - Broken Access Control vulnerability

Vendor Wpdeveloper
Product Document Block – Upload & Embed Docs
Weakness CWE-862 · Missing authorization
Published February 4, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Missing Authorization vulnerability in WPDeveloper Document Block – Upload & Embed Docs document.This issue affects Document Block – Upload & Embed Docs: from n/a through <= 1.1.0.

Explanation of Vulnerability in Simple Terms

02Summary

The Document Block plugin for WordPress does not properly check user permissions before allowing certain actions. A logged-in user with low privileges can modify or delete document data without authorization. The vulnerability affects versions up to 1.1.0. Site administrators should update to a version newer than 1.1.0 when available.

What an attacker can do

03Attacker Capabilities

A logged-in user can modify or delete document data without proper authorization checks.

Potential impact on your site

04Site Impact

Unauthorized users can alter or remove documents managed by the plugin, potentially disrupting content or workflows.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).

Key dates

06Disclosure timeline

February 4, 2025 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57954 Elide 7.1.17 - Permission Bypass in Sort Expression Validation CVE-2026-1239 Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint CVE-2026-57353 WordPress Link Whisper Premium plugin <= 2.9.0 - Broken Access Control vulnerability CVE-2026-12133 JoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Deletion via season_groupdel AJAX action CVE-2026-57669 WordPress Advanced Contact form 7 DB plugin <= 2.0.9 - Broken Access Control vulnerability