CVE-2026-85000

MediumCVSS 5.3

Published: 14/10/2026(UTC)Updated: 14/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

5th percentile - higher than 5% of all known CVEs

Summary

The EmbedPress WordPress plugin before version 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credential-bearing request to a third-party API and stores attacker-controlled cache entries, allowing unauthenticated attackers to consume the site owner's third-party API quota and write unbounded records into the site's database.

Risk Assessment

An attacker can exhaust the site owner's API quota, causing costs or service disruptions, and flood the database with unlimited records, potentially leading to performance issues or resource exhaustion.

Recommendation

Update the EmbedPress plugin to version 4.6.8 or later, which includes the fix adding capability and nonce checks.

Other vulnerabilities in EmbedPress WordPress plugin

CVE-2026-89330Medium
The EmbedPress plugin for WordPress in all versions up to and including 4.6.5 is vulnerable to Reflected Cross-Site Scripting via the 'unique' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute if they can trick a user into clicking a link. This is a regression: the esc_url() wrapper that remediated CVE-2023-5749 was removed in version 4.3.0 during a refactor.

Original NVD description (English source)

The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credential-bearing request to a third-party API and stores attacker-controlled cache entries, allowing unauthenticated attackers to consume the site owner's third-party API quota and write unbounded records into the site's database.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS