Document Embedder CVE-2026-109370

Requires an authenticated WordPress account with contributor-level capability or higher (PR:L) able to create/edit posts containing a Document Embedder block. The attacker must craft the block JSON so that documentSource.doc carries the payload and docId=0, which forces can_read_document() to return false and diverts execution to the de_track_download AJAX fallback path. Exploitation is further LIMITED by needing a victim to actually click the embedded document's Download button - the description states the payload triggers specifically on that click - so despite the supplied UI:N metric, real-world execution depends on victim interaction. Affects all versions up to and including 2.4.0; upgrading to 2.4.1 (per the trac changeset) is the remediation.

This is a moderate, not emergency, priority. The input CVSS is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and vuln.today assigns a 'this_month' decision label, consistent with a medium-severity authenticated stored XSS rather than a drop-everything issue. Exploitation requires PR:L - per the vector and description, a contributor-level (or higher) authenticated account - so this is not remotely exploitable by anonymous attackers. No EPSS score was provided, the CVE is not listed in CISA KEV, and no proof-of-concept or exploit reference is present in the input (only the Wordfence advisory and vendor source-code/changeset links), so per the signals available this is 'no public exploit identified at time of analysis.' CONFLICT TO VERIFY: the supplied vector states UI:N, but the description is explicit that the payload fires only 'when the victim clicks the embedded document's Download button' - that is user interaction, so UI:N appears inconsistent with the described trigger and should be verified with the vendor/Wordfence. The combination of required authentication, required victim interaction, and limited (C:L/I:L, A:N) impact places real-world risk below what the base score alone might suggest, though the S:C (scope-changed) rating correctly reflects that injected script executes in other users' browser sessions.

An attacker who holds or obtains a contributor-level WordPress account embeds a Document Embedder block and sets its document source to a crafted javascript/attacker-controlled href while supplying docId=0, which makes can_read_document() return false and routes the Download action through the de_track_download AJAX fallback. When an administrator or other visitor later views the page and clicks the embedded document's Download button, the plugin's view.js programmatically builds an anchor with the attacker-controlled href and invokes .click(), executing the attacker's script in the victim's browser context. No public exploit code is identified in the provided data, though the vendor source references pinpoint the exact vulnerable code paths.