WordPress EmbedPress plugin < 4.6.8 - Unauthenticated YouTube API Quota Consumption and Database Bloating vulnerability

Unauthenticated YouTube API Quota Consumption and Database Bloating vulnerability discovered by Alberto Ucendo Martínez in WordPress Plugin EmbedPress versions 4.6.8...

CVE-2026-85000

The EmbedPress WordPress plugin (versions before 4.6.8 ) is vulnerable to unauthenticated YouTube API quota consumption and database bloating . The root cause is a lack of capability or nonce checks on unauthenticated requests that trigger server-side, credential-bearing requests to a third-party...

CVE-2026-85000 EmbedPress < 4.6.8 - Unauthenticated YouTube API Quota Consumption and Database Bloating

The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credential-bearing request to a third-party API and stores attacker-controlled cache entries, allowing unauthenticated attackers to consume the si...