CVE-2019-19589

The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives. Note: It has been argued that "The vulnerability reported in PDF Embedder Plugin is not valid as the plugin itself doesn't control or manage the file upload process. It only serves the uploaded PDF files and the responsibility of uploading PDF file remains with the Site owner of Wordpress installation, the upload of PDF file is managed by Wordpress core and not by PDF Embedder Plugin. Control & block of polyglot file is required to be taken care at the time of upload, not on showing the file. Moreover, the reference mentions retrieving the files from the browser cache and manually renaming it to jar for executing the file. That refers to a two step non-connected steps which has nothing to do with PDF Embedder.

• CWE-436
• CWE-436

• https://sejalivre.org/usando-arquivos-polyglot-para-distribuir-malwares/Exploit, Third Party Advisory
• https://wordpress.org/plugins/pdf-embedder/#developersRelease Notes
• https://sejalivre.org/usando-arquivos-polyglot-para-distribuir-malwares/Exploit, Third Party Advisory
• https://wordpress.org/plugins/pdf-embedder/#developersRelease Notes

Published

Dec 5, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-19581An issue was discovered in Xen through 4.12.x allowing 32-bi…6.5
• CVE-2019-19582An issue was discovered in Xen through 4.12.x allowing x86 g…6.5
• CVE-2019-19583An issue was discovered in Xen through 4.12.x allowing x86 H…7.5
• CVE-2019-19585An issue was discovered in rConfig 3.9.3. The install script…7.8
• CVE-2019-19587In WSO2 Enterprise Integrator 6.5.0, reflected XSS occurs wh…6.1
• CVE-2019-19588The validators package 0.12.2 through 0.12.5 for Python ente…7.5
• CVE-2019-1959Multiple vulnerabilities in Cisco Enterprise NFV Infrastruct…4.4
• CVE-2019-19590In radare2 through 4.0, there is an integer overflow for the…7.8
• CVE-2019-19592Jama Connect 8.44.0 is vulnerable to stored Cross-Site Scrip…6.1
• CVE-2019-19594reset/modules/fotoliaFoto/multi_upload.php in the RESET.PRO …9.8
• CVE-2019-19595reset/modules/advanced_form_maker_edit/multiupload/upload.ph…9.8
• CVE-2019-19596GitBook through 2.6.9 allows XSS via a local .md file.5.4