Continuous-variable (CV) measurement-device-independent (MDI) quantum key distribution (QKD) can remove the feasible side-channel attacks on detectors based on the accurate Bell-state measurement (BSM), where an optical amplitude modulator (AM) plays a crucial role in managing the intensity of the transmitted light pulse. However, the AM-involved practical security has remained elusive as the operating frequency of the AM usually determines the actual secret key rate of the CV-MDI-QKD system. We find that an imperfect pulse generated from the AM at high speed can lead to a challenge to the practical security as a minor intensity change of the light pulse can bring about a potential information leakage. Taking advantage of this flaw, we suggest an attack strategy targeting the embedded AM in CV-MDI-QKD without sending the local oscillator (LO). This attack can damage the AM and thus decrease the estimated secret key rate of the system even when the orthogonal local LO (LLO) scheme is carried out. To assess the practical security risk resulting from the leaked information from the AM, we conduct numerical simulations to demonstrate the influence of the AM on the CVMDI-QKD system.