CVE-2026-7526

Vulnerability

The PDF Embedder plugin for WordPress versions up to and including 4.9.3 exposes sensitive configuration data through the enqueue_block_assets function. The vulnerability allows authenticated attackers with contributor-level access or higher to extract configuration values. In installations where the premium add-on is installed with a saved license key, the full license key is exposed; otherwise, non-sensitive viewer settings (width, height, toolbar options, usage tracking, plan) are revealed [1][2][3][4].

Exploitation

An attacker must have an authenticated WordPress account with contributor-level access or above. No special privileges beyond that are required. The attacker can trigger the vulnerability by visiting or interacting with a page that loads the block assets from the plugin. The function enqueue_block_assets outputs the configuration data, which is then accessible via the browser's developer tools or network responses [1][2][3][4].

Impact

Successful exploitation leads to unauthorized disclosure of configuration data. In Lite-only installations, this includes viewer preferences that may aid in further attacks. When the premium add-on is active with a saved license key, the attacker obtains the full license key, which could be used to deactivate the license or access additional protected features [1][2][3][4].

Mitigation

A patched version is available in the WordPress plugin repository via changeset 3531901; the fix was committed on 2026-03-24. Users should update the PDF Embedder plugin to version 4.9.4 or later. For users unable to update immediately, there is no known workaround other than restricting contributor-level access or disabling the plugin until patched [1][2][3][4].