CVE-2026-85000

Deferred Deferred - Pending Action

Unauthenticated API Quota Abuse in EmbedPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description

The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credential-bearing request to a third-party API and stores attacker-controlled cache entries, allowing unauthenticated attackers to consume the site owner's third-party API quota and write unbounded records into the site's database.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-85000

EUVD

EUVD-2026-100851

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	EmbedPress	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability affects the WordPress plugin EmbedPress versions before 4.6.8. It allows unauthenticated attackers to send requests that trigger server-side API calls to third-party services like YouTube without proper checks. This lets attackers consume the site owner's API quota and store unlimited attacker-controlled data in the site's database.

Detection Guidance

Check if the EmbedPress plugin version is below 4.6.8 by inspecting the WordPress admin panel or using commands like 'wp plugin list' in WP-CLI. Look for unusual API requests to YouTube or excessive database entries.

Impact Analysis

If you use EmbedPress before version 4.6.8, attackers could exploit this to drain your third-party API quotas (e.g., YouTube API) and fill your database with unwanted records. This may slow down your site, increase costs, or disrupt functionality.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA due to unauthorized database writes and third-party API quota consumption. Uncontrolled data insertion may lead to unauthorized data processing or storage, which conflicts with GDPR's data integrity and purpose limitation principles. For HIPAA, it risks exposing protected health information if attacker-controlled records contain sensitive data.

Mitigation Strategies

Update the EmbedPress plugin to version 4.6.8 or later immediately. If updating is not possible, consider disabling the plugin until an update is applied to prevent exploitation.

Hi! I’m here to help you understand CVE-2026-85000. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70