WordPress Plugin Vulnerabilities

EmbedPress 4.6.0 - 4.6.3 - Contributor+ Administrator Email Disclosure via Google Reviews REST Route

Description

The plugin does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from that role.

Proof of Concept

Affects Plugins

Plugin icon
embedpress
Fixed in 4.6.4

References

CVE
CVE-2026-84926

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
2.7 (low)

Miscellaneous

Original Researcher
Revanth Hari Narayana Matte
Submitter
Revanth Hari Narayana Matte
Verified
Yes
WPVDB ID
5f1bc0f2-1112-4f75-b2b6-27498e43cd4b

Timeline

Publicly Published
2026-09-03 (about 3 days ago)
Added
2026-09-03 (about 2 days ago)
Last Updated
2026-09-03 (about 2 days ago)

Other

Published
Title
Published
2026-08-07
Title
WPJAM Basic < 7.0.3 - Authenticated (Subscriber+) Information Exposure
Published
2024-04-05
Title
FG Drupal to WordPress < 3.71.0 - Sensitive Information Exposure
Published
2024-08-08
Title
My Custom CSS PHP & ADS <= 3.3 - Unauthenticated Full Path Disclosure
Published
2025-01-06
Title
Duplicate Post, Page and Any Custom Post < 3.5.6 - Authenticated (Contributor+) Post Disclosure via Post Duplication
Published
2026-08-03
Title
Password Protected < 2.8.4 - Unauthenticated Sensitive Information Exposure via REST API