EUVD-2026-40897
GHSA-wpqv-235c-6c75
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Subscriber auth gives PR:L, restriction to zero-argument callables and environment dependence gives AC:H, and the primitive yields mainly disclosure so C:H with minimal I and no A impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to and including 4.0.3. This is due to insufficient validation of the 'path' parameter in the emd_delete_file() AJAX handler in includes/common-functions.php. The user-supplied value is passed through sanitize_text_field(), has its trailing '_PLUGIN_DIR' substring stripped, and is then invoked as a PHP function name with no arguments via $sess_name(). The handler is gated only by a nonce - no current_user_can() check is present - and the nonce is emitted on any front-end page that renders a form shortcode containing file fields. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke arbitrary zero-argument PHP functions (such as phpinfo, phpversion, get_defined_vars, error_get_last), resulting in sensitive information disclosure and potential further compromise depending on the functions available in the environment.
Articles & Coverage 1
AnalysisAI
Arbitrary zero-argument PHP function invocation in the Youtube Showcase (Video Gallery - YouTube Gallery, Playlist & Video Grid) plugin for WordPress affects all versions up to and including 4.0.3, letting authenticated Subscriber-level users abuse the emd_delete_file() AJAX handler to call any callable PHP function name with no arguments. Because the handler validates only a nonce and omits a current_user_can() capability check, low-privileged accounts can trigger functions such as phpinfo(), get_defined_vars(), or error_get_last() to disclose sensitive server and application data. No public exploit identified at time of analysis and the issue is not in CISA KEV, so risk is currently theoretical but credible given the low privilege bar.
Technical ContextAI
The flaw lives in includes/common-functions.php in the emd_delete_file() AJAX callback. A user-supplied 'path' parameter is passed through sanitize_text_field(), has a trailing '_PLUGIN_DIR' substring stripped, and the resulting string is then executed as a dynamic function call via $sess_name(). Dynamic invocation of an attacker-influenced identifier is the root cause; it is classified as CWE-98 (PHP Remote/Local File Inclusion) and tagged LFI, though the concrete primitive here is arbitrary function-name invocation rather than file inclusion per se. Only zero-argument functions can be reached because the call site passes no arguments, which constrains impact to callables that leak state or environment information. The affected package is emarket-design's 'video_gallery_-_youtube_gallery,_playlist_&_video_grid' per the provided CPE, and the nonce that gates the handler is emitted on any front-end page rendering a form shortcode with file fields, meaning the entry point is reachable without an admin-only screen.
RemediationAI
No explicit fixed version number is stated in the available data, but an upstream fix is available in the WordPress plugin repository via changeset 3588198 (https://plugins.trac.wordpress.org/changeset?reponame=youtube-showcase&old=3588198%40youtube-showcase&new=3588198%40youtube-showcase) - released patched version not independently confirmed, so upgrade to the latest available Youtube Showcase release above 4.0.3 and confirm the emd_delete_file() handler now enforces a capability check. Consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/be4743d5-e4ca-4579-84e2-5eb3ef0e274d?source=cve) for the fixed version. Until patched, the highest-value compensating control is to disable open user registration (Settings → General → uncheck 'Anyone can register') so attackers cannot self-provision Subscriber accounts, at the cost of blocking legitimate self-signup; additionally, restrict or block requests to admin-ajax.php for the emd_delete_file action at a WAF or reverse proxy, and remove or unpublish front-end pages that render the plugin's file-field form shortcodes so the gating nonce is never emitted, accepting the trade-off that those upload/delete features become unavailable.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-98 – PHP Remote File Inclusion
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today