CVE-2026-10526

Name of the Vulnerable Software and Affected Versions EmbedPress WordPress plugin versions prior to 4.6.1

Description The plugin fails to validate user-supplied URLs before making server-side requests through unauthenticated endpoints. This allows unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation does not cover, resulting in a blind Server-Side Request Forgery (SSRF). SSRF is a flaw where an attacker can force a server to make requests to an unintended location.

Recommendations Update EmbedPress WordPress plugin to version 4.6.1 or later.