Executive brief
EmbedPress is a WordPress plugin used to embed content from third-party services. The plugin exposes an unauthenticated API endpoint that allows attackers to make billable Google Places API requests using the site owner's configured credentials and to create unlimited database entries. This can lead to unexpected charges and database bloat affecting site performance.
Technical details
The vulnerability is a broken access control issue (CWE-284) in the EmbedPress WordPress plugin affecting versions 4.6.0–4.6.3. The REST API endpoint `/embedpress/v1/google-reviews/page` lacks proper authorization checks, allowing unauthenticated users to invoke it. An attacker can repeatedly call this endpoint with arbitrary `place_id` parameters; each request triggers a billable Google Places Details API call using the site's configured API key and creates a persistent database row. Because there is no authentication requirement, no rate limiting, and the place_id is attacker-controlled, both the API quota consumption and database bloat are unbounded. The vulnerability has been fixed in version 4.6.4.
Affected products
- EmbedPress EmbedPress 4.6.0–4.6.3
Timeline
- 2026-09-03: disclosed: Publicly published on WPScan
- 2026-09-05: patched: Fixed in version 4.6.4
- 2026-09-05: advisory: CVE-2026-84936 published