What is the CVSS score of CVE-2026-48872?

CVE-2026-48872 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of EmbedPress are affected by CVE-2026-48872?

EmbedPress WordPress plugin (versions 4.5.2 and earlier) contains a vulnerability enabling unauthenticated remote access to sensitive site data without requiring credentials or user interaction.

How to fix or mitigate CVE-2026-48872?

Within 24 hours: Identify all WordPress sites running EmbedPress versions 4.5.2 and earlier; document what sensitive data is accessible through the plugin. Within 7 days: Implement interim mitigations (disable the plugin if operationally possible, restrict access via WAF or IP whitelisting, apply access controls); contact EmbedPress vendor to request patch timeline. Within 30 days: Deploy vendor-released patch immediately upon availability, or decommission the plugin if no security update is announced.

EmbedPress CVE-2026-48872

EUVD-2026-36850 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-15 Patchstack

GHSA-w8hp-6w9c-qp6h

Authentication Bypass Information Disclosure Embedpress

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable WordPress endpoint (AV:N/AC:L/PR:N/UI:N) leaking sensitive data justifies C:H; no integrity or availability impact described, so I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:48 vuln.today

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in EmbedPress <= 4.5.2 versions.

AnalysisAI

Unauthenticated sensitive data exposure in the EmbedPress WordPress plugin (versions 4.5.2 and earlier) allows remote attackers to retrieve confidential information from affected sites without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network exploitation against any vulnerable installation, though no public exploit identified at time of analysis. The flaw was disclosed via Patchstack and is classified under CWE-639, suggesting authorization checks are bypassed via predictable or user-controlled object references.

Technical ContextAI

EmbedPress is a WordPress plugin published by wpdeveloper (CPE cpe:2.3:a:wpdeveloper:embedpress) used to embed third-party content such as videos, documents, maps, and social media posts into WordPress posts and pages. The underlying weakness, CWE-639 (Authorization Bypass Through User-Controlled Key), typically arises when an endpoint accepts an identifier supplied by the requester and returns associated data without verifying that the requester is authorized to view it - an IDOR-style flaw. In the EmbedPress context this most likely involves a plugin REST route, AJAX action, or shortcode handler that returns embedded content metadata or configuration without performing capability checks.

RemediationAI

Upgrade EmbedPress to a release newer than 4.5.2 once the wpdeveloper-published fixed version is available; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/embedpress/vulnerability/wordpress-embedpress-plugin-4-5-2-sensitive-data-exposure-vulnerability for the exact patched version, as an upstream fix is referenced but the released patched version is not independently confirmed in the input data. Until upgrade is possible, deactivate the EmbedPress plugin on production sites (which will break any pages relying on its embeds) or front the site with a WAF/virtual-patching rule - Patchstack and Wordfence typically ship signatures for disclosed plugin CVEs - and restrict access to wp-admin and the WordPress REST API (/wp-json/embedpress/* and admin-ajax.php actions referencing embedpress) via IP allowlists where feasible, accepting that REST restrictions may break legitimate front-end embed rendering.