PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-7526 smub CVE debrief

The PDF Embedder plugin for WordPress exposes sensitive configuration data through the `enqueue_block_assets` hook in versions up to and including 4.9.3. Authenticated users with contributor-level access or higher can extract this data. When the premium add-on is installed and a license key has been saved, the exposed data includes the license key. On Lite-only installations, the exposure is limited to non-sensitive viewer configuration values such as width, height, toolbar settings, usage tracking, and plan information. The vulnerability was disclosed on 2026-05-28 and assigned a CVSS 3.1 score of 4.3 (Medium). The issue is tracked as CWE-200 (Information Exposure). A changeset (3531901) in the WordPress plugin repository indicates a patch has been committed to the trunk branch.

Vendor
smub
Product
PDF Embedder
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-08-22
Advisory published
2026-05-28
Advisory updated
2026-08-22

Who should care

WordPress site administrators using PDF Embedder plugin versions 4.9.3 or earlier; security teams monitoring WordPress plugin vulnerabilities; compliance officers concerned with license key exposure in content management systems

Technical summary

The PDF Embedder WordPress plugin registers block assets via `enqueue_block_assets` without adequate access controls or data sanitization, causing configuration objects to be exposed in rendered page output. Authenticated users with contributor privileges or higher can view this output and extract configuration data. The severity varies by installation type: premium add-on installations risk license key exposure, while Lite installations expose only non-sensitive viewer settings. The vulnerability is classified as CWE-200 (Information Exposure) with a CVSS 3.1 score of 4.3 (Medium). The fix was committed to the plugin repository trunk branch as changeset 3531901.

Defensive priority

medium

Recommended defensive actions

  • Update PDF Embedder plugin to version 4.9.4 or later, which contains the fix in changeset 3531901
  • If immediate patching is not possible, restrict contributor-level access to trusted users only
  • Review access logs for unusual authenticated requests to block editor or frontend assets that may indicate attempted exploitation
  • Audit installed plugins to confirm whether the PDF Embedder premium add-on is present; if so, rotate any exposed license keys after patching
  • Consider implementing additional output filtering on `enqueue_block_assets` hooks site-wide as a defense-in-depth measure

Evidence notes

Vulnerability identified in PDF Embedder plugin for WordPress. Affected versions: up to and including 4.9.3. Attack vector: authenticated (contributor+). Impact: sensitive information exposure including license key when premium add-on present; non-sensitive configuration values on Lite-only installations. CVSS 3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. CWE-200 classification. Patch available via changeset 3531901.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-7526 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-7526

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-7526 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-7526

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.