# EmbedPress <= 4.7.1 - Missing Authorization to Unauthenticated YouTube API Quota Consumption via Video Description Popup

- **ID:** WPSEC-2026-2584
- **Plugin:** EmbedPress (`embedpress`), https://wordpress.org/plugins/embedpress/
- **Affected versions:** from 4.0.11 before 4.7.2
- **Fixed in:** 4.7.2 (Update to 4.7.2 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin High, affected versions Medium (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/embedpress
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2584/

## Description

The EmbedPress plugin for WordPress is vulnerable to unauthorized access via the 'fetch_video_description' AJAX action (YouTube video description popup) in all versions up to, and including, 4.7.1. This is because the action is registered for unauthenticated users and does not check authorization or confirm that the site rendered the requested video ID. This makes it possible for unauthenticated attackers to make the site query the YouTube Data API for arbitrary video IDs with the site's API key, which uses up the site's YouTube API quota and writes cache entries to the database.

## References

- https://wpsec.com/vuln/WPSEC-2026-2584/
- https://plugins.svn.wordpress.org/embedpress/tags/4.7.2/
- https://wordpress.org/plugins/embedpress/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2584/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.