CVE-2026-10526: EmbedPress < 4.6.1 - Unauthenticated Blind SSRF

Q: What is the severity of CVE-2026-10526?

CVE-2026-10526 has a risk rating of 62, indicating a medium level of severity.

Q: How do I fix CVE-2026-10526?

To fix CVE-2026-10526, update the EmbedPress WordPress plugin to version 4.6.1 or later.

Q: What type of vulnerability is CVE-2026-10526?

CVE-2026-10526 is classified as an unauthenticated blind Server-Side Request Forgery (SSRF) vulnerability.

Q: Who can exploit CVE-2026-10526?

CVE-2026-10526 can be exploited by unauthenticated attackers due to the lack of URL validation.

Q: What is the impact of CVE-2026-10526?

The impact of CVE-2026-10526 allows attackers to make unauthorized HTTP requests to internal hosts and services.

Published Aug 4, 2026

Updated

The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation does not cover (a blind Server-Side Request Forgery).

Affected Software

1 affected component

EmbedPress EmbedPress WordPress plugin<4.6.1

Event History

Aug 4, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-10526?

CVE-2026-10526 has a risk rating of 62, indicating a medium level of severity.

How do I fix CVE-2026-10526?

To fix CVE-2026-10526, update the EmbedPress WordPress plugin to version 4.6.1 or later.

What type of vulnerability is CVE-2026-10526?