CVE-2026-10526

MEDIUM

EmbedPress < 4.6.1 - Unauthenticated Blind Server-Side Request Forgery

Title source: manual

Description

The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation does not cover (a blind Server-Side Request Forgery).

References (1)

Core 1

Core References

Exploit exploit vdb-entry technical-description

https://wpscan.com/vulnerability/f4ce1f9c-6116-4166-b995-38a099197d86/

Scores

CVSS v3 5.8

EPSS 0.0023

EPSS Percentile 13.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-918

Status published

Products (1)

None/EmbedPress < 4.6.1

Published Aug 04, 2026

Tracked Since Aug 04, 2026