{"id":"CVE-2024-1803","aliases":["EUVD-2024-17528","GHSA-2w3m-74v7-48pp"],"status":"published","title":"EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps \u0026 Embed Any Documents in Gutenberg \u0026 Elementor \u003c= 3.9.12 - Insufficient Authorization Checks to Block Usual","description":"The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps \u0026 Embed Any Documents in Gutenberg \u0026 Elementor plugin for WordPress is vulnerable to unauthorized access of functionality due to insufficient authorization validation on the PDF embed block in all versions up to, and including, 3.9.12. This makes it possible for authenticated attackers, with contributor-level access and above, to embed PDF blocks.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0028,"percentile":0.20614,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-285","CWE-863"],"published":"2024-05-23T12:43:28Z","modified":"2026-06-17T07:05:02Z","products":[{"vendor":"wpdeveloper","product":"embedpress"},{"vendor":"wpdevteam","product":"embedpress – pdf embedder, embed youtube videos, 3d flipbook, social feeds, docs \u0026 more"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/175e08ce-aec2-427a-90e0-f955711d58b2?source=cve","tags":["x_transferred","Patch","Third Party Advisory"]},{"url":"https://plugins.trac.wordpress.org/changeset/3055856","tags":["x_transferred","Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1803"},{"url":"https://github.com/advisories/GHSA-2w3m-74v7-48pp"}],"sources":{"cve":[{"id":"CVE-2024-1803","title":"EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps \u0026 Embed Any Documents in Gutenberg \u0026 Elementor \u003c= 3.9.12 - Insufficient Authorization Checks to Block Usual","description":"The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps \u0026 Embed Any Documents in Gutenberg \u0026 Elementor plugin for WordPress is vulnerable to unauthorized access of functionality due to insufficient authorization validation on the PDF embed block in all versions up to, and including, 3.9.12. This makes it possible for authenticated attackers, with contributor-level access and above, to embed PDF blocks.","status":"published","published":"2024-05-23T12:43:28.622Z","modified":"2026-04-08T16:37:23.405Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:34:18.259965Z"}],"euvd":[{"id":"EUVD-2024-17528","description":"The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps \u0026 Embed Any Documents in Gutenberg \u0026 Elementor plugin for WordPress is vulnerable to unauthorized access of functionality due to insufficient authorization validation on the PDF embed block in all versions up to, and including, 3.9.12. This makes it possible for authenticated attackers, with contributor-level access and above, to embed PDF blocks.","status":"published","published":"2024-05-23T12:43:28Z","modified":"2026-04-08T16:37:23Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:07.886903Z"}],"ghsa":[{"id":"GHSA-2w3m-74v7-48pp","title":"The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps \u0026...","description":"The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps \u0026 Embed Any Documents in Gutenberg \u0026 Elementor plugin for WordPress is vulnerable to unauthorized access of functionality due to insufficient authorization validation on the PDF embed block in all versions up to, and including, 3.9.12. This makes it possible for authenticated attackers, with contributor-level access and above, to embed PDF blocks.","status":"published","published":"2024-05-23T15:30:39Z","modified":"2026-04-08T18:33:16Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-285","CWE-863"],"updated_at":"2026-11-02T15:07:13.920792Z"}],"nvd":[{"id":"CVE-2024-1803","description":"The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps \u0026 Embed Any Documents in Gutenberg \u0026 Elementor plugin for WordPress is vulnerable to unauthorized access of functionality due to insufficient authorization validation on the PDF embed block in all versions up to, and including, 3.9.12. This makes it possible for authenticated attackers, with contributor-level access and above, to embed PDF blocks.","status":"published","published":"2024-05-23T13:15:08.887Z","modified":"2026-06-17T07:05:02.747Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-285","CWE-863"],"updated_at":"2026-11-02T14:10:02.520903Z"}]}}