Mitigated arbitrary file deletion in Embed Privacy ≤ 1.12.4
Published: – 1 Comment
On May 11, 2026, the Patchstack team notified me about a vulnerability in Embed Privacy version 1.12.3 and lower that allowed a malicious actor to delete any file PHP has access to. Let’s checkout what happened.
Timeline
The researcher “daroo” submitted a vulnerability through the Patchstack Vulnerability Disclosure Program for Embed Privacy on May 10, 2026.
On May 11, 2026, it was verified by Patchstack and said notification was sent to me.
The same day, after 21 minutes to be precise, I uploaded a patch fixing the vulnerability.
The next morning, on May 12, 2026, Patchstack verified that the patch successfully fixes the issue.
Two hours later, I released version 1.12.4 of Embed Privacy to close the vulnerability as soon as possible.
On June 29, 2026, Patchstack published the whole report.
The vulnerability
When enabling auto-downloading of video thumbnails (currently supported for SlideShare, Vimeo, WordPress TV, and YouTube), Embed Privacy stores the filename of the thumbnail as post metadata. Then, on regularly basis, it checks whether the video is still embedded. If not, it deletes the thumbnail whose filename is stored in the post metadata.
In versions before 1.12.4, Embed Privacy didn’t check whether the filename actually does only contain this, a name of a file. Thus, you could traverse the directory the thumbnails are stored in and delete any other file.
Given a stored filename youtube_12345.jpg, it deleted the file in /wp-content/uploads/embed-privacy/thumbnails/youtube_12345.jpg.
However, a malicious actor could save the filename as ../../../../wp-config.php, which would then translate to /wp-content/uploads/embed-privacy/thumbnails/../../../../wp-config.php, which ultimately would end up in the path /wp-config.php and thus delete your WordPress configuration file and break your website.
Anyone able to create a post (not necessarily publish it) could add such malicious post metadata and thus attack the website this way.
The fix
Embed Privacy 1.12.4 uses only the basename of the file, which means that it only uses the last part of a path, which usually acts as the filename. Basically, it’s like you tell it to return the value after the last slash. In the case above, ../../../../wp-config.php becomes wp-config.php and so the final path will be /wp-content/uploads/embed-privacy/thumbnails/wp-config.php. Since there is no such file, Embed Privacy won’t delete anything.
At this stage, thanks daroo for reporting the issue and Patchstack for their Vulnerability Disclosure Program!
wow, the path traversal thing with the thumbnail filenames is wild — could’ve nuked someone’s entire wp-config.php. glad you caught and patched it so fast though.