CVE-2026-12923 describes an arbitrary function call vulnerability in the Youtube Showcase WordPress plugin by emarket-design. The vulnerability exists in versions up to and including 4.0.3 (though no explicit affected versions are provided) within the emd_delete_file() AJAX handler in includes/common-functions.php. The handler processes a user-supplied 'path' parameter that is sanitized but then used as a function name without sufficient validation. The handler is protected only by a nonce, which is exposed on front-end pages rendering forms with file fields, and lacks any user capability checks. This allows authenticated users with low privileges (Subscriber or above) to invoke arbitrary zero-argument PHP functions such as phpinfo(), potentially disclosing sensitive information and enabling further attacks depending on the environment.

An attacker with Subscriber-level access or higher can invoke arbitrary zero-argument PHP functions on the server, leading to sensitive information disclosure. Depending on the PHP functions available, this could facilitate further compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected AJAX handler by implementing proper capability checks (e.g., current_user_can()) and avoid exposing the nonce on publicly accessible pages. Monitor for updates from the vendor emarket-design and apply official patches once released.