{
 "id": "WPSEC-2026-2584",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2584/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2584/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2584/index.md",
 "title": "EmbedPress <= 4.7.1 - Missing Authorization to Unauthenticated YouTube API Quota Consumption via Video Description Popup",
 "description": "The EmbedPress plugin for WordPress is vulnerable to unauthorized access via the 'fetch_video_description' AJAX action (YouTube video description popup) in all versions up to, and including, 4.7.1. This is because the action is registered for unauthenticated users and does not check authorization or confirm that the site rendered the requested video ID. This makes it possible for unauthenticated attackers to make the site query the YouTube Data API for arbitrary video IDs with the site's API key, which uses up the site's YouTube API quota and writes cache entries to the database.",
 "plugin": {
  "slug": "embedpress",
  "name": "EmbedPress",
  "full_name": "EmbedPress",
  "wordpress_org": "https://wordpress.org/plugins/embedpress/",
  "advisories_url": "https://wpsec.com/vuln/plugin/embedpress/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/embedpress"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.0.11",
    "from_inclusive": true,
    "to": "4.7.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.0.11 before 4.7.2"
  ]
 },
 "introduced_in": "4.0.11",
 "fixed_in": "4.7.2",
 "remediation": "Update to 4.7.2 or later.",
 "fix_released": "2026-11-04T13:05:23+00:00",
 "published": "2026-11-05T13:50:33+00:00",
 "updated": "2026-11-05T10:27:20.751156+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2584/",
  "https://plugins.svn.wordpress.org/embedpress/tags/4.7.2/",
  "https://wordpress.org/plugins/embedpress/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/embedpress",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "Medium",
  "as_of": "2026-11-05"
 }
}