Executive brief
EmbedPress is a WordPress plugin that embeds third-party content, including Google Reviews. The plugin fails to properly check user permissions on its Google Reviews API endpoint, allowing any contributor-level user to delete site-wide review configurations and inject malicious ones. This means attackers with minimal WordPress privileges can replace legitimate business reviews with fake ones visible to all site visitors.
Technical details
The vulnerability is a broken access control flaw (CWE-862) in the EmbedPress Google Reviews REST API route (POST /wp-json/embedpress/v1/google-reviews/places). The endpoint checks only for contributor-level capabilities or above, rather than requiring administrative privileges to modify site-wide settings. An authenticated user with the Contributor role can extract a valid REST nonce from the block editor, then use it to send POST requests with "remove" and "add" actions to delete existing places and inject arbitrary ones. The vulnerability is fixed in version 4.6.4; affected versions are 4.6.0 through 4.6.3.
Affected products
- EmbedPress EmbedPress 4.6.0 through 4.6.3
Timeline
- 2026-09-05: disclosed: CVE-2026-84927 published
- 2026-09: patched: Fixed in version 4.6.4