CVE-2026-12923
Deferred Deferred - Pending Action

Arbitrary Function Call in YouTube Showcase WordPress Plugin

Publication date: 2026-07-01

Last updated on: 2026-07-01

Assigner: Wordfence

Description
The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to and including 4.0.3. This is due to insufficient validation of the 'path' parameter in the emd_delete_file() AJAX handler in includes/common-functions.php. The user-supplied value is passed through sanitize_text_field(), has its trailing '_PLUGIN_DIR' substring stripped, and is then invoked as a PHP function name with no arguments via `$sess_name()`. The handler is gated only by a nonce — no current_user_can() check is present — and the nonce is emitted on any front-end page that renders a form shortcode containing file fields. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke arbitrary zero-argument PHP functions (such as phpinfo, phpversion, get_defined_vars, error_get_last), resulting in sensitive information disclosure and potential further compromise depending on the functions available in the environment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-01
Last Modified
2026-07-01
Generated
2026-07-21
AI Q&A
2026-07-01
EPSS Evaluated
2026-07-20
NVD
CVE-2026-12923
EUVD
EUVD-2026-40897

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wordpres_plugin youtube_showcase to 4.0.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Youtube Showcase plugin for WordPress up to version 4.0.3 has a vulnerability that allows an attacker to call arbitrary PHP functions without proper authorization.

This happens because the 'path' parameter in the emd_delete_file() AJAX handler is not properly validated. The user input is sanitized but then used as a function name and invoked with no arguments.

The AJAX handler only checks a nonce but does not verify user capabilities, allowing authenticated users with Subscriber-level access or higher to exploit this.

Detection Guidance

This vulnerability can be detected by identifying if the Youtube Showcase plugin for WordPress is installed and running a version up to and including 4.0.3.

Since the vulnerability involves the emd_delete_file() AJAX handler being accessible with a nonce on front-end pages containing form shortcodes with file fields, detection can involve checking for AJAX requests to this handler.

You can monitor your web server logs or use network traffic analysis tools to look for suspicious AJAX requests targeting the emd_delete_file() endpoint.

Specific commands are not provided in the available resources.

Impact Analysis

An attacker with at least Subscriber-level access can invoke arbitrary zero-argument PHP functions on the server.

This can lead to sensitive information disclosure, such as revealing PHP configuration or environment details.

Depending on the functions available, it may also allow further compromise of the system.

Compliance Impact

This vulnerability allows authenticated attackers with Subscriber-level access and above to invoke arbitrary zero-argument PHP functions, potentially leading to sensitive information disclosure and further compromise.

Such unauthorized disclosure of sensitive information can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and breaches.

Mitigation Strategies

Immediate mitigation steps include updating the Youtube Showcase plugin to a version later than 4.0.3 where this vulnerability is fixed.

If an update is not immediately available, restrict access to the vulnerable AJAX handler by implementing additional permission checks or disabling the plugin temporarily.

Also, monitor and audit user roles to ensure that only trusted users have Subscriber-level access or higher, as the vulnerability requires at least Subscriber-level authentication.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12923. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart