WordPress Plugin Vulnerabilities

EmbedPress < 4.6.1 - Unauthenticated Blind SSRF

Description

The plugin does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation does not cover (a blind Server-Side Request Forgery).

Proof of Concept

Affects Plugins

Plugin icon
embedpress
Fixed in 4.6.1

References

CVE
CVE-2026-10526

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
5.8 (medium)

Miscellaneous

Original Researcher
Ayush Srivastava
Submitter
Ayush Srivastava
Verified
Yes
WPVDB ID
f4ce1f9c-6116-4166-b995-38a099197d86

Timeline

Publicly Published
2026-07-27 (about 8 days ago)
Added
2026-07-27 (about 7 days ago)
Last Updated
2026-07-27 (about 7 days ago)

Other

Published
Title
Published
2026-04-10
Title
UsersWP < 1.2.59 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter
Published
2025-09-03
Title
Exit Intent Popup < 1.0.3 - Unauthenticated Server-Side Request Forgery
Published
2025-03-28
Title
WP Compress for MainWP < 6.30.06 - Authenticated (Subscriber+) Server-Side Request Forgery
Published
2026-06-17
Title
CF7 to Webhook < 5.0.1 - Unauthenticated Server-Side Request Forgery via CF7 Field Placeholder in Webhook URL Host
Published
2024-05-30
Title
Ninja Tables – Easiest Data Table Builder < 5.0.10 - Authenticated (Admin+) Server-Side Request Forgery