Server-Side Request Forgery Vulnerability in EmbedPress Plugin for WordPress
CVE-2026-10526
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 4 August 2026
Badges
What is CVE-2026-10526?
The EmbedPress plugin for WordPress, prior to version 4.6.1, suffers from a security flaw that leads to unvalidated user-supplied URLs being processed. This vulnerability enables unauthenticated attackers to exploit the system, causing the server to make unintended HTTP requests to internal services and hosts that are not covered by WordPress core URL validation mechanisms. Such blind Server-Side Request Forgery (SSRF) can result in unauthorized access to sensitive information or services within the network, posing a serious risk to the integrity and security of the affected WordPress installations.
Affected Version(s)
EmbedPress 0 < 4.6.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.