Exploitation Research Plan: CVE-2026-1389 - Document Embedder IDOR

1. Vulnerability Summary

The Document Embedder plugin for WordPress (versions <= 2.0.4) contains multiple Insecure Direct Object Reference (IDOR) vulnerabilities in its AJAX handlers. Specifically, the actions bplde_save_document_library, bplde_get_single, and bplde_delete_document_library do not verify that the authenticated user has permission to access or modify the specific entry identified by the id parameter.

While the handlers are restricted to authenticated users (Author level and above), they lack checks to ensure the id belongs to the requesting user or that the user has administrative privileges to manage others' entries. This allows an attacker with an Author-level account to read, modify, or delete document library entries created by any other user, including administrators.

2. Attack Vector Analysis

• Endpoints: wp-admin/admin-ajax.php
• AJAX Actions:
  • bplde_save_document_library (Update/Overwrite)
  • bplde_get_single (Read)
  • bplde_delete_document_library (Delete)
• Vulnerable Parameter: id (The database ID of the document library entry).
• Authentication Required: Authenticated user with Author role or higher.
• Preconditions: The attacker must be logged in as an Author and know (or brute-force) the id of the target document library entry.

3. Code Flow

1. The plugin registers AJAX handlers in the constructor of its main class or an AJAX handler class (likely using add_action( 'wp_ajax_bplde_...', ... )).
2. An Author user sends a POST request to admin-ajax.php with action=bplde_delete_document_library&id=[TARGET_ID].
3. The handler function (e.g., bplde_delete_document_library()) is invoked.
4. The handler likely checks for a nonce using check_ajax_referer or wp_verify_nonce.
5. Crucially, the handler retrieves the id from $_POST['id'] and performs a database operation (e.g., $wpdb->delete(...) or wp_delete_post(...)) without verifying if the current user owns the entry or has manage_options capabilities.
6. The entry is deleted/modified/leaked regardless of ownership.

4. Nonce Acquisition Strategy

The plugin likely localizes a nonce for these AJAX actions. Based on the action names, the localization key is likely related to bplde or doc_embedder.

1. Identify Entry Point: Document Library management usually happens in the WordPress dashboard.
2. Create Setup Page: If the nonce is only loaded on the plugin's admin page, we must navigate there.
3. Extraction:
   • Login as the Author user.
   • Navigate to the Document Embedder dashboard: /wp-admin/admin.php?page=document-embedder-library (inferred slug).
   • Use browser_eval to find the nonce.
   • Search Target: Look for a global object like bplde_ajax_obj or document_embedder_vars.
   • Inferred Script Variable: window.bplde_ajax?.nonce or window.bplde_params?.nonce.

5. Exploitation Strategy (Deletion Focus)

This plan focuses on the bplde_delete_document_library action to demonstrate impact.

Step 1: Admin creates a "Target" Document

The administrator creates a document library entry that the Author should not be able to delete.

Step 2: Author retrieves ID and Nonce

The Author logs in and identifies the id of the admin's document (via bplde_get_all if accessible, or by simple incrementing/brute-forcing if IDs are sequential).

Step 3: Execution of Unauthorized Deletion

The Author sends the following request:

HTTP Request:

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=bplde_delete_document_library&id=[TARGET_ID]&nonce=[EXTRACTED_NONCE]

6. Test Data Setup

1. Users:
   • Admin: admin_user
   • Author: attacker_author (Role: Author)
2. Document Entry:
   • As admin_user, create a document library entry via the plugin UI.
   • Capture the ID of this entry (e.g., 1).
3. Plugin State: Ensure Document Embedder is active.

7. Expected Results

• Response: The server should return a success message (e.g., {"success":true} or a string 1).
• Outcome: The document library entry with id=[TARGET_ID] is removed from the database.
• Bypass Confirmation: The deletion occurs even though the attacker_author does not own the entry.

8. Verification Steps

1. List Documents via WP-CLI:

   # If the plugin uses a Custom Post Type (check for 'bplde_doc' or similar)
   wp post list --post_type=document_library 
   
   # If the plugin uses a custom table (more likely)
   wp db query "SELECT * FROM wp_bplde_document_library WHERE id = [TARGET_ID];"
   

2. Confirm Absence: The query should return no results after the exploit.

9. Alternative Approaches

A. Information Disclosure (bplde_get_single)

If deletion is too destructive for the environment, use bplde_get_single to read entry details.

• Action: bplde_get_single
• Payload: action=bplde_get_single&id=[TARGET_ID]&nonce=[NONCE]
• Expected: JSON response containing document details (e.g., file URLs, titles) belonging to the Admin.

B. Unauthorized Modification (bplde_save_document_library)

Overwrite an admin's document entry with attacker-controlled data.

• Action: bplde_save_document_library
• Payload: action=bplde_save_document_library&id=[TARGET_ID]&title=HACKED&nonce=[NONCE]
• Expected: The Admin's entry title changes to "HACKED".