Unauthorized Access Flaw in EmbedPress Plugin for WordPress
CVE-2026-84936
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 5 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-84936?
The EmbedPress plugin for WordPress, prior to version 4.6.4, suffers from an authorization flaw in its public review-loading action. This vulnerability allows unauthenticated users to execute repeated, unauthorized requests to billable third-party APIs using the site's API key. This can lead to creating an unlimited number of rows controlled by the attacker in the database, posing significant risks to the site's security and integrity.
Affected Version(s)
EmbedPress 4.6.0 < 4.6.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.