CVE-2026-10526

UNKNOWN 0.0

EmbedPress < 4.6.1 - Unauthenticated Blind SSRF

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation does not cover (a blind Server-Side Request Forgery).

Vendor	unknown
Product	embedpress
Published	Aug 4, 2026

Stay Ahead of the Next One

Get instant alerts for unknown embedpress

Be the first to know when new unknown vulnerabilities affecting unknown embedpress are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / EmbedPress

0 < 4.6.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/f4ce1f9c-6116-4166-b995-38a099197d86/

Credits

Ayush Srivastava WPScan