Vulnerabilities / EmbedPress / WPSEC-2026-2584
EmbedPress <= 4.7.1 - Missing Authorization to Unauthenticated YouTube API Quota Consumption via Video Description Popup
Medium 6.5
CWE-862Fixed in 4.7.2
- ID
- WPSEC-2026-2584
- Plugin
- EmbedPress (embedpress)
- Affected
- from 4.0.11 before 4.7.2
- Remediation
- Update to 4.7.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-862
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-11-05
- Attack surface
- EmbedPress on WPSec AttackSurface
- Fix released
- Published
Description
The EmbedPress plugin for WordPress is vulnerable to unauthorized access via the 'fetch_video_description' AJAX action (YouTube video description popup) in all versions up to, and including, 4.7.1. This is because the action is registered for unauthenticated users and does not check authorization or confirm that the site rendered the requested video ID. This makes it possible for unauthenticated attackers to make the site query the YouTube Data API for arbitrary video IDs with the site's API key, which uses up the site's YouTube API quota and writes cache entries to the database.
References
- https://wpsec.com/vuln/WPSEC-2026-2584/
- https://plugins.svn.wordpress.org/embedpress/tags/4.7.2/
- https://wordpress.org/plugins/embedpress/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS