PDF Embedder CVE-2026-7526

Exploitation requires an authenticated WordPress account with at minimum contributor-level role on the target site. The CVSS vector (PR:L) confirms this authentication prerequisite. The highest-severity impact - license key exposure - additionally requires that the premium PDF Embedder add-on be installed alongside the base plugin and that a license key has been saved to the plugin's configuration. Lite-only installations are affected by the same code path but expose only non-sensitive configuration values (width, height, toolbar settings, usage tracking, plan indicator), substantially reducing real-world impact. Sites that restrict contributor access to a small, trusted set of authors are largely protected in practice, even without patching.

The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately reflects a moderate, low-impact information disclosure. The network attack vector and low complexity are real - any contributor on a multi-author WordPress site can exploit this without special conditions - but the Low privileges requirement (PR:L) anchors the risk: an attacker must already hold a valid contributor account. Confidentiality impact is Low and scoped to Unchanged, meaning the blast radius is limited to the data exposed, not broader system access. The practical risk bifurcates significantly by installation type: on premium installs with a stored license key, license key theft is a meaningful business impact (financial loss, service interruption if key is revoked or resold); on Lite installs, the exposed data is genuinely low-sensitivity. No EPSS score was provided in the source data, so exploitation probability cannot be quantified numerically. There is no KEV listing and no known public exploit, making this a lower operational priority than its network-accessible vector might initially suggest. Organizations running premium add-ons with multi-author contributor roles are the meaningful risk population.

An attacker who holds a contributor account on a target WordPress site - obtained via registration, credential theft, or purchase - authenticates and triggers a page load in the block editor context. The enqueue_block_assets hook fires and exposes the plugin's configuration data in the page output; if the premium add-on is installed with a saved license key, the key is included in that output and can be read directly from the page source or network response. No public exploit code has been identified at time of analysis, but exploitation requires only standard web browsing and credential access at a low privilege level.