CVE-2026-85000
CVE-2026-85000 · EmbedPress < 4.6.8 - Unauthenticated YouTube API Quota Consumption and Database Bloating
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credential-bearing request to a third-party API and stores attacker-controlled cache entries, allowing unauthenticated attackers to consume the site owner's third-party API quota and write unbounded records into the site's database.
CVSS 5.3 · Moyenne · EPSS 0,2% · Correctif disponible
- Publication
- Mise à jour
Produits et versions concernés
embedpress
- Versions du logiciel
- ≥ 0, < 4.6.8: Concernée (semver)
Mettez à jour vers 4.6.8