Executive brief
EmbedPress is a WordPress plugin that allows sites to embed external content, including Google Reviews. The plugin's Google Reviews feature failed to properly restrict access to an administrative email retrieval endpoint, allowing any contributor-level user (and above) to view the site administrator's email address—information that WordPress normally hides from this role. This could enable targeted phishing or account takeover attacks against site administrators.
Technical details
The vulnerability is an authorization bypass (CWE-200: Exposure of Sensitive Information) in the Google Reviews REST API endpoint `/wp-json/embedpress/v1/google-reviews/managed/status`. The endpoint requires authentication (REST nonce) but fails to enforce admin-only access controls, allowing any authenticated user with contributor-level privileges or above to call it. The response JSON includes the site's admin_email field, which is normally restricted to administrators. An attacker needs a valid contributor account on the WordPress site; no CSRF or privilege escalation chain is required. The vulnerability affects EmbedPress versions 4.6.0 through 4.6.3 and was fixed in version 4.6.4.
Affected products
- EmbedPress EmbedPress 4.6.0 - 4.6.3
Timeline
- 2026-09-03: disclosed
- 2026-09-04: patched: Fixed in version 4.6.4