What is the CVSS score of CVE-2026-10526?

CVE-2026-10526 has a CVSS 3.1 base score of 5.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-10526?

Yes, a public proof-of-concept exploit is available for CVE-2026-10526. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-10526?

Yes, a patch is available for CVE-2026-10526. Update the affected software to the latest version immediately.

EmbedPress CVE-2026-10526

EUVD-2026-52581 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-08-04 WPScan

GHSA-5hhp-vm23-j9g4

WordPress SSRF Embedpress Unknown

5.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

5.8 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

vuln.today AI

5.8 MEDIUM

Unauthenticated network endpoint with no interaction required; scope changes because internal-network systems outside WordPress are reached; confidentiality limited to blind probing, no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 15:33 vuln.today

Patch available

Aug 04, 2026 - 07:01 EUVD

CVE Published

Aug 04, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 04, 2026 - 06:00 cve.org

MEDIUM 5.8

DescriptionCVE.org

The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation does not cover (a blind Server-Side Request Forgery).

AnalysisAI

Blind Server-Side Request Forgery in the EmbedPress WordPress plugin (all versions before 4.6.1) allows unauthenticated remote attackers to coerce the WordPress server into issuing arbitrary HTTP requests to internal hosts and services, bypassing WordPress core URL validation entirely. The vulnerability exists on unauthenticated endpoints, requiring zero credentials or user interaction, making mass exploitation trivially automatable against any site running a vulnerable plugin version. A publicly available proof-of-concept exists (via WPScan), though EPSS of 0.14% (4th percentile) suggests exploitation remains limited in practice; no active exploitation is confirmed by CISA KEV.

Technical ContextAI

CWE-918 (Server-Side Request Forgery) describes a class of vulnerability where an application fetches remote resources based on attacker-supplied input without sufficient validation of the destination URL. EmbedPress, a WordPress plugin designed to embed external media content (YouTube, Vimeo, etc.), processes user-supplied embed URLs through server-side HTTP requests. The flaw arises from the plugin's failure to validate these URLs before issuing requests on unauthenticated endpoints - specifically bypassing WordPress core URL validation, which itself does not cover all internal/private address ranges. The affected CPE is cpe:2.3:a:unknown:embedpress:*:*:*:*:*:*:*:* covering all versions up to but not including 4.6.1. Because the CVSS scope is Changed (S:C), the vulnerable WordPress process acts as a proxy into the internal network segment it inhabits, targeting services that are not directly internet-accessible.

RemediationAI

The primary fix is to update EmbedPress to version 4.6.1 or later via the WordPress admin dashboard (Plugins > Updates) or the WordPress CLI using 'wp plugin update embedpress'. The vendor-released patch (4.6.1) addresses URL validation on the affected unauthenticated endpoints. Advisory details are available at https://wpscan.com/vulnerability/f4ce1f9c-6116-4166-b995-38a099197d86/. If immediate patching is not feasible, compensating controls include: (1) deploying a web application firewall rule to block requests to the plugin's embed endpoint that contain private IP ranges (RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata addresses (169.254.169.254) - note this may block legitimate embed previews; (2) restricting network egress from the WordPress server to only approved external domains, which limits SSRF reach but may break embed functionality; (3) on cloud-hosted deployments, enforcing IMDSv2 (AWS) or equivalent metadata service hardening to prevent credential theft via SSRF to the metadata endpoint.