UNKNOWN NVD

CVE-2026-85000

The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credenti

The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credential-bearing request to a third-party API and stores attacker-controlled cache entries, allowing unauthenticated attackers to consume the site owner's third-party API quota and write unbounded records into the site's database.

References

https://wpscan.com/vulnerability/3c7f7d07-2c46-4839-b97f-27fe41e6292d/

Published: 2026-10-14 · Source: NVD · Feed updated: 2026-10-14

This unknown severity vulnerability was published on 2026-10-14 via NVD.

vulnfeed aggregates 14664 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.