CVE-2026-84936 in EmbedPress Plugin
Summary
by MITRE • 09/05/2026
The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounded number of attacker-controlled rows in the database.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability identified in EmbedPress versions prior to 4.6.4 represents a critical failure in access control mechanisms within the WordPress plugin ecosystem. Specifically, the flaw resides in a public action designed for loading reviews from third-party services such as Google or Facebook. In a secure implementation, any operation that modifies state or consumes significant resources must be protected by authentication and authorization checks to ensure only legitimate administrators can trigger these actions. However, due to improper validation of user capabilities, this endpoint remains accessible to unauthenticated actors on the internet. This lack of restriction allows external attackers to interact with the plugin's functionality without possessing valid credentials, effectively bypassing the intended security boundaries established by WordPress core and the plugin developer.
From a technical perspective, the exploitation vector leverages the site’s own configured API keys for third-party services. When an unauthenticated user triggers this action, the server executes code that utilizes these privileged credentials to fetch data from external APIs. This creates two distinct avenues of abuse: resource exhaustion via billable requests and database integrity compromise through mass row insertion. The attacker can script automated calls to this endpoint, causing the WordPress site to repeatedly query third-party services. Since many review aggregation services charge per API call or enforce rate limits that may result in account suspension for excessive usage, this behavior directly translates into financial loss for the website owner. Furthermore, the vulnerability allows the creation of an unbounded number of rows within the local database controlled by the attacker. This can lead to significant storage exhaustion and performance degradation as the database grows uncontrollably large with malicious data entries.
The operational impact of this vulnerability extends beyond immediate resource consumption. The ability to inject arbitrary data into the database poses a risk to data integrity and potentially opens pathways for further exploitation if those stored values are later rendered without proper sanitization, although the primary concern here is denial of service through cost and storage exhaustion. For businesses relying on EmbedPress to display social proof or reviews, this vulnerability can disrupt site performance, increase hosting costs due to database bloat, and incur direct financial penalties from third-party API providers. Additionally, if the injected data interacts with other parts of the application logic that do not properly validate input types, it could theoretically lead to secondary vulnerabilities such as stored cross-site scripting or SQL injection, depending on how the review data is processed downstream in the theme or plugin codebase.
Mitigation strategies must prioritize immediate remediation through software updates and defensive configuration measures. The most effective solution is to upgrade EmbedPress to version 4.6.4 or later, where this authorization flaw has been addressed by implementing proper capability checks on the affected action hooks. For sites that cannot immediately update due to compatibility concerns with other plugins, temporary mitigation involves restricting access to WordPress admin-ajax.php and related endpoints via web application firewall rules or server-level configurations like .htaccess files. Administrators should also monitor their third-party API usage logs for unusual spikes in request volume which may indicate active exploitation of this vulnerability. Regular auditing of database size and review entries can help detect the aftermath of an attack, allowing for timely cleanup to restore normal operational performance.
This incident aligns with CWE-284 Improper Access Control, as it involves a failure to restrict access to resources that are intended only for authorized users. It also relates to CWE-770 Allocation of Resources Without Limits or Throttling, given the unbounded nature of the database row creation and API calls. In terms of offensive security frameworks, this vulnerability facilitates actions consistent with ATT&CK technique T1496 Resource Hijacking, where attackers leverage compromised resources for their own benefit, in this case causing financial harm through billable API usage and operational disruption via resource exhaustion. Understanding these classifications helps organizations contextualize the severity within broader threat landscapes and prioritize patching efforts accordingly to maintain robust security postures against similar access control failures.