{
 "id": "WPSEC-2026-1874",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1874/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1874/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1874/index.md",
 "title": "WP Document Revisions <= 5.8.1 - Unauthenticated Sensitive Information Exposure via oEmbed Document Attachment File Names",
 "description": "The WP Document Revisions plugin for WordPress is vulnerable to Sensitive Information Exposure via the oEmbed lookup and attachment titles in all versions up to, and including, 5.8.1. This is due to document attachments being titled with their stored file name, which was returned to anonymous users. This makes it possible for unauthenticated attackers to learn stored file names and, on sites that do not block direct access to the uploads folder, download the files of password-protected documents or earlier revisions of published documents.",
 "plugin": {
  "slug": "wp-document-revisions",
  "name": "WP Document Revisions",
  "full_name": "WP Document Revisions",
  "wordpress_org": "https://wordpress.org/plugins/wp-document-revisions/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-document-revisions/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-document-revisions"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.8.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.8.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.8.2",
 "remediation": "Update to 5.8.2 or later.",
 "fix_released": "2026-10-27T20:29:25+00:00",
 "published": "2026-10-28T20:44:49+00:00",
 "updated": "2026-10-28T09:11:51.880481+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1874/",
  "https://plugins.svn.wordpress.org/wp-document-revisions/tags/5.8.2/",
  "https://wordpress.org/plugins/wp-document-revisions/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-document-revisions",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-28"
 }
}