WP Document Revisions <= 5.6.1 - Authenticated (Author+) Sensitive Information Exposure via Media Library
- ID
- WPSEC-2026-0068
- Plugin
- WP Document Revisions (wp-document-revisions)
- Affected
- all versions before 5.7.0
- Remediation
- Update to 5.7.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- WP Document Revisions on WPSec AttackSurface
- Fix released
- Published
Description
The WP Document Revisions plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 5.6.1. When block editor mode for documents is enabled (off by default), the Media Library grid (query-attachments) did not hide document attachments. In either mode, the media modal's get-attachment AJAX action returned the title, original and stored file names and URL of any attachment ID, without checking whether the user can edit the parent document. This makes it possible for authenticated attackers with Author-level access and above to enumerate the files of other users' private, draft and password-protected documents and, where the document directory is reachable by the web server without the plugin's rewrite protection, download them directly.
References
- https://wpsec.com/vuln/WPSEC-2026-0068/
- https://plugins.svn.wordpress.org/wp-document-revisions/tags/5.7.0/
- https://wordpress.org/plugins/wp-document-revisions/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS