Anonymous REST _embed query fan-out amplification

Summary

The REST _embed option can fan out one collection request into many embedded subrequests. Each item can trigger additional queries and response preparation, creating an amplification path for unauthenticated clients.

Affected Products

WordPress core 7.0.4; REST API embedding.

Affected Scope

Product

WordPress

Component

REST API embedding and collection queries

Affected function

_embed; WP_REST_Server embedding; collection per_page; linked-resource resolution

Affected versions

WordPress 7.0.4 (revalidated). Earlier/fixed versions are not asserted without a pinned vendor confirmation.

Safe version

No fixed version confirmed in the supplied material.

CWE

CWE-400; CWE-770

Technical Summary

The _embed flag multiplies work across collection items by resolving linked resources and their queries for each item. The missing bound is the amplification primitive.

Prerequisites and Permissions

Unauthenticated access to a public REST collection with embeddable relations; no account is required.

Affected Locations

wp-includes/rest-api/class-wp-rest-server.php embedding path; collection controllers; _embed and per_page parameters.

Reproducible Proof

Controlled requests with the same collection and increasing _embed fan-out showed proportional extra subrequest/query work. Exact load-generation details are withheld.

Vulnerable Code

$served = apply_filters( &class="tok-comment">#39;rest_pre_serve_request', false, $result, $request, $this );
if ( ! $served ) {
	if ( &class="tok-comment">#39;HEAD' === $request->get_method() ) {
		return null;
	}
	$embed  = isset( $_GET[&class="tok-comment">#39;_embedclass="tok-string">'] ) ? rest_parse_embed_param( $_GET['_embed'] ) : false;
	$result = $this->response_to_data( $result, $embed );
}

Severity

medium

Technical Analysis

A collection request with _embed causes the REST server to resolve linked resources for each returned item. The fan-out repeats per item and can invoke expensive post/user/term queries, while collection counting adds additional database work.

Impact

Availability impact: an unauthenticated client can amplify CPU and database work per request. The effect is deployment-dependent and does not by itself disclose protected objects or execute code.

Remediation

Cap collection size when _embed is requested, bound embedded-resource depth/count, avoid repeated count queries, and add per-route cost/rate controls.

Timeline

• 2026-09-15Published
• 2026-09-15Advisory published

Credits

Reported by Aria Akhavan. Disclosure timeline: 2026-08-12 submission; 2026-09-07 follow-up; no response documented by 2026-09-14.