Authorization Flaw in EmbedPress Plugin by WordPress
CVE-2026-84927
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 5 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-84927?
The EmbedPress plugin for WordPress prior to version 4.6.4 lacks adequate authorization checks on its Google Reviews REST API routes. This deficiency permits users with Contributor roles and above to alter site-wide store configurations, including the ability to delete pre-existing entries set by administrators and inject their own. As a result, altered reviews are publicly displayed across the site, potentially compromising site integrity and user trust.
Affected Version(s)
EmbedPress 4.6.0 < 4.6.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.