CVE-2026-12923 is a high-severity vulnerability in the emarket-design Video Gallery – YouTube Gallery, Playlist & Video Grid WordPress plugin. The issue arises from improper control of the filename for an include/require statement, specifically an arbitrary function call via the 'path' parameter in the emd_delete_file() AJAX handler. The parameter is sanitized with sanitize_text_field() and partially stripped, but then used as a PHP function name without arguments. The handler is only protected by a nonce and lacks a current_user_can() capability check, allowing authenticated users with low privileges (Subscriber and above) to execute arbitrary zero-argument PHP functions such as phpinfo(), leading to information disclosure and potential further impact.

An attacker with Subscriber-level access or higher can invoke arbitrary zero-argument PHP functions on the server, which may disclose sensitive information such as PHP configuration, environment variables, or error details. This can facilitate further attacks or compromise of the affected system. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles that can access forms rendering the vulnerable shortcode, and monitor for suspicious AJAX requests involving the 'path' parameter. Implement additional access control checks (e.g., current_user_can()) in the AJAX handler to limit function invocation to trusted users.