# CVE-2026-84936: EmbedPress missing authorization in Google Reviews API endpoint

Source: https://junglewise.ai/threats/cve-2026-84936-embedpress-missing-authorization-in-google-reviews-api-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-05. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-84936 · Severity: medium · CVSS 5.3 · Published 2026-09-05

EmbedPress is a WordPress plugin used to embed content from third-party services. The plugin exposes an unauthenticated API endpoint that allows attackers to make billable Google Places API requests using the site owner's configured credentials and to create unlimited database entries. This can lead to unexpected charges and database bloat affecting site performance.

## Quick answers

**Is CVE-2026-84936 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84936 being exploited in the wild.

**How severe is CVE-2026-84936?** Medium severity, with a CVSS score of 5.3, published 5 September 2026.

**Which products and versions are affected?** EmbedPress EmbedPress 4.6.0–4.6.3.

**Is there a fix for CVE-2026-84936?** A patch was published on 2026-09-05: Fixed in version 4.6.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84936 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-84936?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a broken access control issue (CWE-284) in the EmbedPress WordPress plugin affecting versions 4.6.0–4.6.3. The REST API endpoint `/embedpress/v1/google-reviews/page` lacks proper authorization checks, allowing unauthenticated users to invoke it. An attacker can repeatedly call this endpoint with arbitrary `place_id` parameters; each request triggers a billable Google Places Details API call using the site's configured API key and creates a persistent database row. Because there is no authentication requirement, no rate limiting, and the place_id is attacker-controlled, both the API quota consumption and database bloat are unbounded. The vulnerability has been fixed in version 4.6.4.

## Affected products

- EmbedPress EmbedPress 4.6.0–4.6.3

## Timeline

- 2026-09-03: disclosed: Publicly published on WPScan
- 2026-09-05: patched: Fixed in version 4.6.4
- 2026-09-05: advisory: CVE-2026-84936 published

## References

- [https://wpscan.com/vulnerability/bd708c98-1657-423b-aa2b-14aa18307c03/](https://wpscan.com/vulnerability/bd708c98-1657-423b-aa2b-14aa18307c03/)