CVE-2026-12923
Received Received - Intake

Arbitrary Function Call in YouTube Showcase WordPress Plugin

Publication date: 2026-07-01

Last updated on: 2026-07-01

Assigner: Wordfence

Description
The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to and including 4.0.3. This is due to insufficient validation of the 'path' parameter in the emd_delete_file() AJAX handler in includes/common-functions.php. The user-supplied value is passed through sanitize_text_field(), has its trailing '_PLUGIN_DIR' substring stripped, and is then invoked as a PHP function name with no arguments via `$sess_name()`. The handler is gated only by a nonce — no current_user_can() check is present — and the nonce is emitted on any front-end page that renders a form shortcode containing file fields. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke arbitrary zero-argument PHP functions (such as phpinfo, phpversion, get_defined_vars, error_get_last), resulting in sensitive information disclosure and potential further compromise depending on the functions available in the environment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-01
Last Modified
2026-07-01
Generated
2026-07-01
AI Q&A
2026-07-01
EPSS Evaluated
N/A
NVD
CVE-2026-12923
EUVD
EUVD-2026-40897

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wordpres_plugin youtube_showcase to 4.0.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Youtube Showcase plugin for WordPress up to version 4.0.3 has a vulnerability that allows an attacker to call arbitrary PHP functions without proper authorization.

This happens because the 'path' parameter in the emd_delete_file() AJAX handler is not properly validated. The user input is sanitized but then used as a function name and invoked with no arguments.

The AJAX handler only checks a nonce but does not verify user capabilities, allowing authenticated users with Subscriber-level access or higher to exploit this.

Impact Analysis

An attacker with at least Subscriber-level access can invoke arbitrary zero-argument PHP functions on the server.

This can lead to sensitive information disclosure, such as revealing PHP configuration or environment details.

Depending on the functions available, it may also allow further compromise of the system.

Compliance Impact

This vulnerability allows authenticated attackers with Subscriber-level access and above to invoke arbitrary zero-argument PHP functions, potentially leading to sensitive information disclosure and further compromise.

Such unauthorized disclosure of sensitive information can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and breaches.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12923. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart