Skip to content
fr Sign in
2.7 Low

CVE-2026-84927 The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google…

Description

The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which are rendered publicly across the site.

Affected products and versions

Product Affected versions Fixed in
EmbedPress 4.6 4.6.0 → < 4.6.4 4.6.4

References

Timeline

  1. Published
  2. Last modified

Other CVEs of EmbedPress

The 9 CVEs of EmbedPress →
CVE-2026-85000 The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated… 5.3 Medium CVE-2026-85001 The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before… 6.8 Medium CVE-2026-85002 The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an… 6.8 Medium CVE-2026-84936 The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action,… 5.3 Medium
Track this CVE