CVE-2026-10526 — EmbedPress < 4.6.1 - Unauthenticated Blind SSRF
The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated…
Published: 2026-08-04 · CVSS: 5.8 · CVSS 3.1
The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation does not cover (a blind Server-Side Request Forgery).
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7