Description
The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounded number of attacker-controlled rows in the database.
Published: 2026-09-05
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unrestricted API Key Abuse
Action: Patch
AI Analysis

Impact

The flaw in the EmbedPress plugin allows anyone on the internet to trigger the site’s Google Reviews API calls using the site’s own API key, causing unexpected billing charges. In addition, the same request creates unlimited attacker-controlled rows in the database, which can lead to storage exhaustion and data integrity problems. The weakness is an improper authorization check for a public review‑loading action, permitting unauthenticated users to exercise these abilities.

Affected Systems

This vulnerability is present in EmbedPress WordPress plugin versions 4.6.0 through 4.6.3. Versions 4.6.4 and later include the fix for the missing authorization guard.

Risk and Exploitability

The EPSS score is <1%, indicating a very low likelihood of exploitation, while the CVSS score of 5.3 reflects moderate risk. The vulnerability is not listed in the CISA KEV catalog. Because unauthenticated users can trigger the API calls by simply accessing a crafted URL, the attack is trivial to execute. The alternative effect of unbounded database row creation increases the risk of economic damage from third‑party API usage and potential service degradation from excessive data growth.

Generated by OpenCVE AI on September 6, 2026 at 15:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade EmbedPress to version 4.6.4 or later, which implements proper authorization for the review‑loading action.
  • Audit the database for rows added by this vulnerability and remove any unused or malicious entries immediately.
  • Configure the web server or a WAF to block or rate‑limit unauthenticated requests to the review‑loading endpoint until the plugin is patched.
  • If the Google Reviews feature is unnecessary, disable it in the plugin settings or reset the API key to be restricted to the site’s domain to limit abuse.

Generated by OpenCVE AI on September 6, 2026 at 15:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 06 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400

Sun, 06 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 05 Sep 2026 08:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-400

Sat, 05 Sep 2026 06:30:00 +0000

Type Values Removed Values Added
Description The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounded number of attacker-controlled rows in the database.
Title EmbedPress 4.6.0 - 4.6.3 - Unauthenticated Google Reviews API Quota Consumption and Database Bloat
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-09-06T10:23:48.136Z

Reserved: 2026-09-02T16:28:22.323Z

Link: CVE-2026-84936

cve-icon Vulnrichment

Updated: 2026-09-06T10:23:27.247Z

cve-icon NVD

Status : Deferred

Published: 2026-09-05T07:17:14.873

Modified: 2026-09-08T19:15:18.627

Link: CVE-2026-84936

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-06T16:00:12Z

Weaknesses