EmbedPress CVE-2026-48872

No special conditions - remote unauthenticated exploitation against default configurations of EmbedPress 4.5.2 and earlier, requiring only that the plugin be installed and active on a network-reachable WordPress site. Limiting factors: confidentiality impact only, so the attacker cannot modify content or take over the site through this flaw alone; exploitation is bounded to whatever data the vulnerable endpoint exposes (likely embed configurations, draft/private post embed metadata, or API keys stored by integrations), and sites not using EmbedPress are unaffected.

The CVSS 3.1 base score of 7.5 reflects network reach, low attack complexity, no privileges, and no user interaction, with confidentiality fully impacted but integrity and availability untouched - consistent with a pure information-disclosure bug. There is no KEV listing and no public exploit identified at time of analysis, and EPSS data was not provided, so real-world exploitation pressure cannot be quantified from the supplied intelligence. However, WordPress plugin disclosures via Patchstack are routinely weaponized by mass-scanning botnets within days of publication, and the unauthenticated nature plus large WordPress install base means defenders should treat this as a near-term priority rather than a theoretical issue. No conflicting signals were observed in the input data.

An attacker enumerates WordPress sites running EmbedPress 4.5.2 or earlier using fingerprinting (plugin readme.txt, asset paths) and then issues unauthenticated HTTP requests to the vulnerable plugin endpoint, iterating over object identifiers to harvest sensitive embedded content or configuration data. Because no authentication, user interaction, or special conditions are required, this can be scripted at scale across the WordPress ecosystem; no public exploit identified at time of analysis, but the simplicity of the vector means weaponization is straightforward once the endpoint becomes known.