EmbedPress <= 3.7.3 - Sensitive Information Exposure
Priority MEDIUM 40CWE-321Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-321.
Summary
The EmbedPress plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'lock_content_form_handler' and 'display_password_form' function in versions up to, and including, 3.7.3. This makes it possible for unauthenticated attackers to decrypt and view the password protected content.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00539 45th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| wpdevteam | EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more | up to 3.7.3 | — | No fix listed | CNA |
- EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Vendorwpdevteam Affected up to 3.7.3 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-3371
- 2026-10-03 Alias added: GHSA-rjrp-832p-5v8p
References
Patch 2
Other 3
- https://plugins.trac.wordpress.org/browser/embedpress/tags/3.7.3/Gutenberg/block-backend/block-embedpress.php#L30
- https://plugins.trac.wordpress.org/browser/embedpress/tags/3.7.3/EmbedPress/Includes/Classes/Helper.php#L231
- https://plugins.trac.wordpress.org/browser/embedpress/tags/3.7.3/EmbedPress/Includes/Classes/Helper.php#L278
More wpdevteam Embedpress vulnerabilities
- TI-2024-20660 WordPress EmbedPress plugin <= 3.9.8 - Broken Access Control vulnerability CVSS 3.1CRITICAL 9.8
- TI-2024-28980 WordPress EmbedPress plugin <= 4.0.9 - Local File Inclusion vulnerability CVSS 3.1CRITICAL 9.8
- TI-2024-25941 WordPress EmbedPress plugin <= 4.0.4 - Broken Access Control vulnerability CVSS 3.1HIGH 8.8
- TI-2023-28033 WordPress EmbedPress plugin <= 3.8.3 - Broken Access Control vulnerability CVSS 3.1HIGH 8.8
- TI-2024-20650 WordPress EmbedPress plugin <= 3.9.11 - Broken Access Control vulnerability CVSS 3.1MEDIUM 5.3
- TI-2024-29525 WordPress EmbedPress plugin <= 4.0.8 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
Sources
- CVE-2023-3371 · CVE Program
- CVE-2023-3371 · NVD
- FIRST EPSS
- GHSA-rjrp-832p-5v8p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences