WordPress Plugin Vulnerabilities
EmbedPress 4.6.0 - 4.6.3 - Unauthenticated Google Reviews API Quota Consumption and Database Bloat
Description
The plugin does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounded number of attacker-controlled rows in the database.
Proof of Concept
Affects Plugins
Fixed in 4.6.4 References
CVE
Classification
Type
ACCESS CONTROLS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
RIA Labs
Submitter
RIA Labs
Submitter website
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-09-03 (about 19 hours ago)
Added
2026-09-03 (about 5 hours ago)
Last Updated
2026-09-03 (about 5 hours ago)
WPScan 