# CVE-2026-48872: EmbedPress sensitive data exposure via authorization bypass

Source: https://junglewise.ai/threats/cve-2026-48872-embedpress-sensitive-data-exposure-via-authorization-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-48872 · Severity: high · CVSS 7.5 · Published 2026-06-15

EmbedPress is a WordPress plugin used to embed videos, maps, and other social media content into websites. A security flaw allows unauthenticated visitors to access sensitive information that should be restricted to site administrators. This exposure could lead to further attacks or the leakage of private configuration data, potentially compromising the entire website.

Technologies: [WPDeveloper EmbedPress](https://junglewise.ai/threats/technologies/embedpress). Vendors: [WPDeveloper](https://junglewise.ai/threats/vendors/wpdeveloper).

## Quick answers

**Is CVE-2026-48872 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48872 being exploited in the wild.

**How severe is CVE-2026-48872?** High severity, with a CVSS score of 7.5, published 15 June 2026.

**Which products and versions are affected?** WPDeveloper EmbedPress <= 4.5.2.

**Is there a fix for CVE-2026-48872?** A patch was published on 2026-06-01: Version 4.5.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48872 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48872?** Check whether you run WPDeveloper EmbedPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

EmbedPress versions 4.5.2 and earlier are vulnerable to sensitive data exposure due to an authorization bypass through a user-controlled key (CWE-639). The vulnerability allows a remote, unauthenticated attacker to access sensitive information by manipulating input parameters. This occurs because the plugin fails to properly validate the authorization of the requester before returning data. An attacker can exploit this over the network without any user interaction to gain access to restricted information. The issue is resolved in version 4.5.3.

## Affected products

- WPDeveloper EmbedPress <= 4.5.2

## Timeline

- 2026-05-07: other: Reported by Mukhlis Amien
- 2026-06-01: patched: Version 4.5.3 released
- 2026-06-15: disclosed: NVD publication date

## References

- [https://patchstack.com/database/wordpress/plugin/embedpress/vulnerability/wordpress-embedpress-plugin-4-5-2-sensitive-data-exposure-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/embedpress/vulnerability/wordpress-embedpress-plugin-4-5-2-sensitive-data-exposure-vulnerability?_s_id=cve)

## Related threats

- [WPDeveloper EmbedPress Stored XSS in Gutenberg block url attribute](https://junglewise.ai/threats/cve-2026-7796-wpdeveloper-embedpress-stored-xss-in-gutenberg-block-url-attribute)