Code Embed CVE-2026-48093

The Code Embed plugin (CPE: cpe:2.3:a:dartiss:code-embed) provides a WordPress token mechanism that embeds external code snippets into post content by specifying a remote URL. The vulnerable code path in includes/add-embeds.php called ce_quick_replace() unconditionally for both HTTP and HTTPS URL tokens, fetching the remote resource and inserting the raw response body into $content via str_replace() without any sanitization. This is a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) violation: user-controllable data-the URL itself and the remote server's arbitrary response-entered the output stream directly. WordPress's role-capability model reserves the unfiltered_html capability for Administrators and Editors; Contributors explicitly lack it. The plugin failed to gate URL-embed expansion on this capability, so Contributor-authored posts could carry URL tokens that execute attacker-controlled content when rendered by any higher-privileged reviewer. The fix introduces two complementary controls: a save_post hook (ce_save_url_embed_permission) that stamps the post with a meta flag recording whether the post author held unfiltered_html at save time, and a runtime gate that suppresses URL-embed expansion for posts lacking that flag; fetched content is additionally passed through wp_kses_post() for sanitization.