CVE-2026-85000: EmbedPress WordPress Plugin SSRF Vulnerability

CVE-2026-85000 Overview

CVE-2026-85000 affects the EmbedPress WordPress plugin in versions prior to 4.6.8. The plugin exposes an unauthenticated endpoint that triggers a server-side, credential-bearing request to a third-party API and stores attacker-controlled cache entries. Because the handler performs no capability or nonce check, remote attackers can abuse the site owner's third-party API quota and write unbounded records into the WordPress database. The flaw is categorized under [CWE-284] (Improper Access Control).

Critical Impact
Unauthenticated attackers can exhaust third-party API quotas tied to the site owner's credentials and inflate the WordPress database through unbounded cache writes.

Affected Products

EmbedPress WordPress plugin versions prior to 4.6.8
WordPress sites with EmbedPress installed and activated
Site owners using third-party API integrations configured within EmbedPress

Discovery Timeline

2026-10-14 - CVE-2026-85000 published to the National Vulnerability Database
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-85000

Vulnerability Analysis

The vulnerability stems from a missing authorization layer on a plugin endpoint that is reachable without authentication. The endpoint accepts attacker-supplied input, forwards it to a third-party API using the site's stored credentials, and caches the response in the WordPress database. No nonce validation, capability check, or rate limiting gates the request.

Two abuse paths exist. First, each request consumes a unit of the site owner's third-party API quota, which can be depleted at low cost to the attacker. Second, each unique input produces a new cache record, allowing attackers to inject unbounded rows into the database and degrade site performance.

Root Cause

The plugin omits WordPress capability checks such as current_user_can() and nonce validation via check_ajax_referer() on the vulnerable handler. The handler proxies attacker-controlled parameters directly into a signed outbound API call and persists the result without validating the originator or deduplicating cache keys.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker issues repeated unauthenticated HTTP requests to the affected plugin endpoint, varying input parameters to force fresh API lookups and new cache entries. No user interaction or credentials are needed. See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-85000

Indicators of Compromise

High volumes of unauthenticated requests to EmbedPress plugin endpoints from a small set of source IP addresses
Rapid growth of EmbedPress cache tables or transients in the WordPress database
Unexpected depletion of third-party API quota tied to credentials configured in EmbedPress

Detection Strategies

Review web server access logs for repeated POST or GET requests to EmbedPress AJAX or REST endpoints lacking authentication cookies
Query the wp_options and plugin-specific cache tables for unusual row count growth over short time intervals
Correlate third-party API dashboard usage spikes with WordPress request logs to identify abuse windows

Monitoring Recommendations

Enable web application firewall (WAF) logging for plugin endpoints and alert on request rate anomalies
Monitor WordPress database size and table growth with scheduled checks
Set billing and quota alerts on third-party API provider dashboards to catch abuse early

How to Mitigate CVE-2026-85000

Immediate Actions Required

Upgrade the EmbedPress plugin to version 4.6.8 or later on all affected WordPress sites
Rotate any third-party API credentials configured within EmbedPress if abuse is suspected
Audit EmbedPress cache tables and prune attacker-generated entries

Patch Information

The maintainers addressed the issue in EmbedPress version 4.6.8 by adding authorization and nonce checks to the affected endpoint. Site administrators should update through the WordPress plugin manager or by replacing the plugin files with the fixed release. Refer to the WPScan Vulnerability Report for release details.

Workarounds

Block or rate-limit requests to the vulnerable EmbedPress endpoint at the WAF or reverse proxy until patching is complete
Temporarily deactivate the EmbedPress plugin on sites that cannot upgrade immediately
Restrict access to /wp-admin/admin-ajax.php and REST routes used by EmbedPress to authenticated users where feasible

bash

# Example nginx rate limit for the vulnerable endpoint
limit_req_zone $binary_remote_addr zone=embedpress:10m rate=5r/m;

location = /wp-admin/admin-ajax.php {
    limit_req zone=embedpress burst=10 nodelay;
    include fastcgi_params;
    fastcgi_pass php-fpm;
}