Youtube Showcase CVE-2026-12923

Requires an authenticated WordPress account at Subscriber level or above (CVSS PR:L confirms authentication), plus access to a front-end page that renders a Youtube Showcase form shortcode containing file fields - that page emits the nonce needed to pass the handler's only gate. The attacker must supply a 'path' value that, after sanitize_text_field() and stripping a trailing '_PLUGIN_DIR', matches the exact name of an existing zero-argument PHP function; the call passes no arguments, so only argument-free callables are usable. Limiting factors: sites without open registration or with tightly controlled Subscriber accounts sharply reduce reachability, high attack complexity (AC:H) reflects dependence on the specific functions present in the target environment, and no code-execution-with-arguments is possible through this primitive, capping impact largely at information disclosure.

The signals are mixed. The published CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H yields 7.5 (High), but the I:H and A:H claims appear overstated for a primitive limited to zero-argument function calls, which realistically produces information disclosure rather than full integrity or availability compromise - verify with vendor. PR:L confirms authentication is required (Subscriber-level and above), so this is not remotely unauthenticated. AC:H reflects the genuine constraint that only argument-free functions are reachable and outcomes depend on which callables exist in the target environment. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active or imminent exploitation; treat this as no public exploit identified at time of analysis. Net: a real but moderate-priority issue for sites that allow open user registration (where any visitor can become a Subscriber), and lower priority for closed sites where Subscriber accounts are tightly controlled.

On a WordPress site that permits self-registration, an attacker registers a Subscriber account, browses to a front-end page containing a Youtube Showcase form shortcode to harvest the emitted nonce, then sends a crafted admin-ajax.php POST to the emd_delete_file action with a 'path' value resolving to a function like phpinfo or get_defined_vars. The server invokes that function and returns environment secrets (paths, configuration, loaded variables) that seed further attacks. No public POC is referenced, and the high attack complexity means results vary with the functions available in the target's PHP environment.