emarket-design Video Gallery Plugin up to 4.0.3 on WordPress AJAX common-functions.php emd_delete_file sess_name filename control

Summaryinfo

A vulnerability was found in emarket-design Video Gallery Plugin up to 4.0.3 on WordPress. It has been classified as critical. Affected by this vulnerability is the function emd_delete_file of the file includes/common-functions.php of the component AJAX Handler. The manipulation of the argument sess_name leads to filename control. This vulnerability is listed as CVE-2026-12923. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as critical, has been found in emarket-design Video Gallery Plugin up to 4.0.3 on WordPress. This issue affects the function emd_delete_file of the file includes/common-functions.php of the component AJAX Handler. The manipulation of the argument sess_name with an unknown input leads to a filename control vulnerability. Using CWE to declare the problem leads to CWE-98. The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to and including 4.0.3. This is due to insufficient validation of the 'path' parameter in the emd_delete_file() AJAX handler in includes/common-functions.php. The user-supplied value is passed through sanitize_text_field(), has its trailing '_PLUGIN_DIR' substring stripped, and is then invoked as a PHP function name with no arguments via `$sess_name()`. The handler is gated only by a nonce — no current_user_can() check is present — and the nonce is emitted on any front-end page that renders a form shortcode containing file fields. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke arbitrary zero-argument PHP functions (such as phpinfo, phpversion, get_defined_vars, error_get_last), resulting in sensitive information disclosure and potential further compromise depending on the functions available in the environment.

The weakness was presented by PRISM. It is possible to read the advisory at wordfence.com. The identification of this vulnerability is CVE-2026-12923 since 06/22/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/01/2026).

By approaching the search of inurl:includes/common-functions.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-40897). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Photo Gallery Software

Vendor

• emarket-design

Name

• Video Gallery Plugin

Version

• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion