CVE-2026-7526: PDF Embedder <= 4.9.3 - Authenticated (Contributor+) Information Exposure via Block Editor Page
Vulnerability summary
CVE-2026-7526 is a medium (CVSS 4.3) vulnerability in smub pdf embedder – pdf viewer & embed pdf files for wordpress. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34.4% of scored vulnerabilities. Fixed in 5.0.0.
Timeline
- 28-05-2026PublishedVulnerability first disclosed.
- 22-08-2026Last modifiedVulnerability information updated.
Description
The PDF Embedder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.9.3 via the enqueue_block_assets. This makes it possible for authenticated attackers, with contributor-level access and above, to extract configuration data. License key exposure occurs when the premium add-on is also installed and has saved a key; on Lite-only installations, the exposed data is limited to non-sensitive viewer configuration values such as width, height, toolbar settings, usage tracking, and plan.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- wordfenceSource4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.41%
Chance of exploitation in the next 30 days
Percentile
34%
Versus all other CVEs
30-day change
Increase +0.04 pp
From 0.38% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Smub1 product
Wordpress1 product
- pdf-embedder≤ 4.9.3 (fixed in 5.0.0)
2 vendors · 2 products