Mitigated arbitrary file deletion in Embed Privacy ≤ 1.12.4

On May 11, 2026, the Patchstack team notified me about a vulnerability in Embed Privacy version 1.12.3 and lower that allowed a malicious actor to delete any file PHP has access to. Let’s checkout what happened. Timeline The researcher “daroo” submitted a vulnerability through the Patchstack Vulnerability Disclosure Program for Embed Privacy on May 10, [ ]