The vulnerability identified as CVE-2026-48872 affects EmbedPress plugin versions up to 4.5.2. It allows unauthenticated attackers to bypass authorization controls by manipulating a user-controlled key, resulting in sensitive data exposure. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and confidentiality impact only. No official fix or patch has been published, and no known exploits are reported in the wild as of the publication date.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information without requiring authentication. The integrity and availability of the affected system are not impacted. The exposure of sensitive data could facilitate further attacks or compromise user privacy.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No vendor-provided temporary mitigations or workarounds are currently documented.