CVE-2026-10526

unknowncovered by 1 sourcefirst seen 2026-08-04

The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation does not cover (a blind Server-Side Request Forgery).

⚡ Watch CVE-2026-10526

Get an email if CVE-2026-10526 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

unknownCVE-2026-10526: The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before makin…nvd · 2026-08-04

External references

NVD record for CVE-2026-10526

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-10526 status](https://www.csirts.com/badge/CVE-2026-10526)](https://www.csirts.com/cve/CVE-2026-10526)