CVE-2026-12923: Youtube Showcase WordPress Plugin Arbitrary Function Call Vulnerability

Technical summary

The emd_delete_file() AJAX handler in includes/common-functions.php uses sanitize_text_field() on the 'path' parameter and strips a trailing '_PLUGIN_DIR' substring before passing it directly to PHP's function-call operator ($sess_name()). The handler is protected only by nonce verification; no capability check (current_user_can()) gates access. Because the nonce is embedded in front-end form shortcodes, any authenticated user can obtain it. An attacker supplies a PHP function name as the 'path' parameter, which is then invoked with zero arguments. This allows execution of any zero-argument built-in or custom PHP function available in the environment, leading to information disclosure or potential code execution depending on the function's behavior and available execution context.

Business impact

Exploitation enables unauthorized disclosure of sensitive server configuration, environment variables, PHP settings, and error logs—all valuable reconnaissance for further attacks. In multi-tenant or shared hosting scenarios, this could expose credentials, API keys, or database connection strings. The presence of this vulnerability signals that the plugin's security practices are weak, raising questions about other potential issues. Site owners face reputational risk if sensitive data is leaked, and must assume any Subscriber-level account (often used for content contributors, clients, or partners) as a potential attack vector.

Affected systems

The Youtube Showcase WordPress plugin in versions 4.0.3 and earlier is affected. Any WordPress site running this plugin with at least one user account at Subscriber level or above (which includes Contributor, Author, Editor, and Administrator roles) is at risk. The vulnerability is platform-agnostic and affects any server where the plugin is installed, regardless of operating system or hosting environment.

Exploitability

Exploitability is moderate to high. An attacker must have valid WordPress credentials at Subscriber level or above, which is often freely granted to contributors, clients, or partners. No user interaction is required beyond authentication—the attack is automated via AJAX. The attacker does not need to craft complex payloads; function names are supplied as plain text. However, the attack is limited to zero-argument functions, and the attacker has no direct way to see output (though functions like phpinfo() can be leveraged for side-channel information gathering). The vulnerability is not currently in the CISA Known Exploited Vulnerabilities (KEV) catalog, but that does not mean active exploitation is absent—only that it has not been formally added to the government's tracking list.

Remediation

Update the Youtube Showcase plugin to a patched version released after 4.0.3. Verify the specific patch version in the plugin's release notes or vendor advisory. As an interim measure, if the plugin cannot be updated immediately, restrict Subscriber-level access to users who genuinely require it, and consider removing the plugin entirely if its functionality is non-critical. Monitor access logs and AJAX activity for suspicious calls to the emd_delete_file endpoint.

Patch guidance

Apply the latest version of the Youtube Showcase plugin available from the WordPress plugin repository. Verify the update resolves the vulnerability by checking the plugin's changelog or contacting the developer. Test the patch in a staging environment to ensure compatibility with other plugins and custom code before deploying to production. Most sites can apply WordPress plugin updates automatically or with a single click in the WordPress admin panel.

Detection guidance

Monitor WordPress access logs and audit logs for AJAX requests to /wp-admin/admin-ajax.php with action=emd_delete_file. Flag requests where the 'path' parameter contains PHP function names (phpinfo, system, exec, passthru, eval, etc.) or other suspicious patterns. Implement Web Application Firewall (WAF) rules to block or alert on AJAX calls matching this signature. Review user account activity, particularly from Subscriber-level accounts, to identify any unusual API calls. Use WordPress security plugins (such as Wordfence or Sucuri) to monitor file changes and AJAX anomalies.

Why prioritize this

This vulnerability warrants immediate attention because (1) it requires only basic user credentials to exploit, (2) it enables information disclosure that aids further compromise, (3) the nonce is publicly available on front-end pages, and (4) the attack is trivial to automate and difficult to detect without specific log analysis. Organizations with high-trust contributor communities or public registration should treat this as critical; those with tightly controlled accounts may deprioritize slightly. However, the HIGH CVSS score and the ease of exploitation mean this should be in the top tier of remediation efforts.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible vulnerability requiring only Subscriber-level privileges (low but non-negligible barrier), with no user interaction needed, leading to high-impact information disclosure and potential indirect integrity/availability impact through further compromise. The attack complexity is rated High because the attacker must know or guess valid PHP function names and understand the context of what information each function leaks—this prevents a fully automatic exploitation path but does not stop a moderately skilled attacker.

Frequently asked questions