CVE-2026-84926 in EmbedPress Plugin
Summary
by MITRE • 09/05/2026
The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from that role.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability identified in EmbedPress versions prior to 4.6.4 represents a significant authorization flaw within the plugin’s integration of Google Reviews functionality via REST API endpoints. Specifically, the route responsible for retrieving and displaying Google review data fails to enforce proper access controls at the server side. While WordPress core architecture strictly limits certain sensitive user attributes, such as email addresses associated with administrator accounts, from being exposed through standard APIs to users with lower privileges like contributors or authors, this specific endpoint bypasses those restrictions. The flaw allows any authenticated user possessing contributor-level permissions or higher to query the REST API and retrieve information that should be restricted to administrators only.
From a technical perspective, this issue stems from an improper implementation of capability checks within the plugin’s codebase. When registering the custom REST route for Google Reviews, the developer likely omitted the necessary verification step that ensures the requesting user holds administrative privileges before returning sensitive data. In WordPress development, it is standard practice to validate capabilities such as manage_options or edit_users against the current user context using functions like current_user_can(). The absence of this validation means the endpoint operates with insufficient access control, effectively treating all authenticated users equally regardless of their assigned role hierarchy. This oversight creates a direct path for information disclosure that exploits the trust WordPress places in its authentication system without verifying authorization levels appropriately.
The operational impact of this vulnerability centers on unauthorized data exposure and potential privacy violations. By accessing the administrator’s email address through this endpoint, an attacker with even minimal access to the website can gather intelligence about key personnel associated with the site. This information is particularly valuable as it facilitates targeted phishing attacks, such as spear-phishing or whaling campaigns, where attackers use known contact details to craft convincing malicious messages aimed at compromising administrative credentials further. Additionally, exposing administrator email addresses contributes to user enumeration and profile building activities that can aid in broader social engineering efforts against the organization hosting the WordPress site.
This vulnerability aligns with CWE-284, which describes Improper Access Control, specifically highlighting scenarios where access control rules are not enforced correctly for specific users or roles. It also maps closely to MITRE ATT&CK technique T1078, Valid Accounts, as it involves leveraging legitimate but insufficiently privileged credentials to extract sensitive information that should remain hidden. The exploitation of this flaw does not require complex payload construction; rather, it relies on simple HTTP requests directed at the exposed REST endpoint, making it easily exploitable by automated tools or low-skilled attackers who have gained basic access to the platform.
Mitigation strategies for this vulnerability involve immediate updates and configuration adjustments. Site administrators should upgrade EmbedPress to version 4.6.4 or later, where the developers have presumably corrected the authorization logic to properly restrict access to administrative roles only. Until an update is applied, temporary mitigations may include restricting REST API access through web application firewall rules that block requests to specific endpoints from non-administrator IP ranges if feasible, although this approach is less robust than a code fix. Furthermore, implementing strict monitoring of REST API logs can help detect unusual patterns of data retrieval by lower-privileged users, providing an early warning system for potential exploitation attempts. Regular security audits and adherence to secure coding standards that emphasize least privilege principles are essential to preventing similar authorization flaws in future plugin development or custom integrations.