What is the CVSS score of CVE-2026-7526?

CVE-2026-7526 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

PDF Embedder CVE-2026-7526

EUVD-2026-32743 MEDIUM

Information Exposure (CWE-200)

2026-05-28 Wordfence

GHSA-f2w5-jwq5-fprh

Information Disclosure WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 09:21 vuln.today

CVE Published

May 28, 2026 - 07:43 nvd

MEDIUM 4.3

DescriptionCVE.org

The PDF Embedder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.9.3 via the enqueue_block_assets. This makes it possible for authenticated attackers, with contributor-level access and above, to extract configuration data. License key exposure occurs when the premium add-on is also installed and has saved a key; on Lite-only installations, the exposed data is limited to non-sensitive viewer configuration values such as width, height, toolbar settings, usage tracking, and plan.

AnalysisAI

Sensitive information exposure in the PDF Embedder WordPress plugin (all versions through 4.9.3) allows authenticated attackers with contributor-level access or higher to extract configuration data via the enqueue_block_assets hook. The severity of impact is installation-dependent: on sites running the premium add-on with a saved license key, attackers can exfiltrate that license key; on Lite-only installations, exposed data is limited to non-sensitive viewer settings such as dimensions, toolbar preferences, and usage tracking. No public exploit identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

Technical ContextAI

The vulnerability resides in the enqueue_block_assets function of the plugin's core Plugin.php file (confirmed at lines 204 and 224 of the 4.9.3 tag in the WordPress plugin repository). This WordPress action hook is intended to enqueue scripts and styles for the block editor, but the implementation incorrectly inlines or exposes plugin configuration data - including, conditionally, a premium license key - in a way accessible to lower-privilege users. The affected product is identified by CPE cpe:2.3:a:smub:pdf_embedder:*:*:*:*:*:*:*:* (vendor: smub). The root cause class is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), meaning data that should be restricted to administrative contexts is being surfaced to contributor-level users without proper access control checks on the data being output.

RemediationAI

An upstream fix is available in the WordPress plugin repository via changeset 3531901 (https://plugins.trac.wordpress.org/changeset/3531901/pdf-embedder/trunk/src/Plugin.php), which modifies Plugin.php to address the improper data exposure; however, the exact released patched version number is not independently confirmed from the available input data - site administrators should update to the latest available version beyond 4.9.3 via the WordPress admin plugin update screen. As a compensating control on sites where an immediate update is not possible, restricting the contributor role entirely - or limiting the WordPress installation to trusted authors only - eliminates the attack surface, though this may disrupt editorial workflows. Premium license key holders who suspect exposure should consider rotating or reissuing their license key with the plugin vendor (smub) after patching.