CVE-2026-48872: WordPress EmbedPress plugin <= 4.5.2 - Sensitive Data Exposure vulnerability

Synopsis

An unauthenticated sensitive data exposure vulnerability affects the EmbedPress WordPress plugin at version 4.5.2 and earlier. The flaw is reachable over the network without any credentials, meaning any internet-facing WordPress site running the affected plugin is exposed. Successful exploitation allows an attacker to read sensitive data from the affected installation. No fix version has been published yet; HarborGuard tracks this advisory and will surface a patched-image rebuild the moment an upstream fix is available.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable component is exposed over the network, so an attacker must be able to reach the WordPress site via HTTP/HTTPS to trigger the issue.

• AuthenticationNot required

  No account or session token of any kind is needed; the attacker sends unauthenticated requests to exploit the flaw.

• Victim interactionNot required

  No user action is required; the attacker exploits the endpoint directly without any social-engineering step.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites.

Blast Radius

• A successful attacker reads sensitive data exposed by the plugin, which may include configuration details, API keys, or other confidential information stored or surfaced by EmbedPress.
• Confidentiality is fully compromised (CVSS C:H); data that the plugin handles or exposes can be harvested without restriction.
• Integrity and availability are unaffected by this vulnerability; the attacker gains read access only and cannot modify or delete data through this path.