CVE-2026-84927
Received Received - Intake

Unauthorized Store Modification in EmbedPress WordPress Plugin

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: WPScan

Description
The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which are rendered publicly across the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-84927
EUVD
EUVD-2026-71870

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
embedpress embedpress to 4.6.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in the EmbedPress WordPress plugin before version 4.6.4 allows users with the Contributor role or higher to modify site-wide store settings through a Google Reviews REST API route. This is due to a missing authorization check, enabling unauthorized deletion of administrator-configured entries and injection of new content that is publicly displayed across the site.

Detection Guidance

Check the installed version of the EmbedPress plugin. If it is between 4.6.0 and 4.6.3, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

This vulnerability allows unauthorized users to alter public content on your WordPress site, potentially replacing legitimate store entries with malicious or incorrect information. It can damage your site's reputation, mislead visitors, and disrupt business operations by altering displayed content without proper authorization.

Compliance Impact

This vulnerability could lead to non-compliance with data integrity and access control requirements in GDPR and HIPAA. Unauthorized modifications to public content may violate regulations requiring accurate data handling and protection, potentially resulting in legal and financial penalties.

Mitigation Strategies

Update the EmbedPress plugin to version 4.6.4 or later immediately. Remove or disable the plugin if updating is not possible. Review site content for unauthorized changes and restore from a clean backup if necessary.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84927. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart