Executive brief
Epiphyt Embed Privacy is a WordPress plugin used to manage third-party content embeds while protecting user privacy. A security flaw in this plugin allows an attacker with basic contributor-level access to delete arbitrary files on the web server. This could lead to a complete website outage if critical system files are removed, or allow attackers to bypass security controls by deleting configuration files.
Technical details
A path traversal vulnerability (CWE-22) in the Epiphyt Embed Privacy plugin for WordPress allows for arbitrary file deletion. The flaw exists due to improper limitation of pathnames, enabling an attacker to navigate outside of intended directories. An authenticated attacker with 'Contributor' or higher privileges can exploit this via network requests to delete sensitive files on the server, including WordPress core files or .htaccess configurations. This can result in a denial-of-service (DoS) condition or further system compromise. The issue is fixed in version 1.12.4.
Affected products
- Epiphyt Embed Privacy up to 1.12.3
Timeline
- 2026-05-10: other: Reported by researcher daroo
- 2026-06-29: advisory: Published by Patchstack and NVD
- 2026-06-29: patched: Version 1.12.4 released to address the vulnerability