The EmbedPress WordPress plugin before version 4.6.8 permits unauthenticated requests to a server‑side endpoint that sends a credential‑bearing request to the third‑party YouTube API. The plugin fails to perform capability or nonce validation, allowing attackers to trigger YouTube API calls and store attacker‑controlled cache entries. This results in unauthorized consumption of the site owner’s YouTube API quota and the insertion of unbounded records into the site’s database.

The affected product is the EmbedPress WordPress plugin, for all releases prior to 4.6.8. No specific vendor is listed beyond the plugin identifier.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1% implies a very low probability of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalog. Likely the attack vector is an unauthenticated HTTP request to a publicly reachable endpoint that triggers the vulnerable code. An attacker can consume the site owner’s YouTube API quota and cause database bloating, potentially leading to performance degradation or denial of service, but would not provide code execution or privilege escalation under the information given.