CVE-2026-84926: EmbedPress 4.6.0 - 4.6.3 - Contributor+ Administrator Email Disclosure via Google Reviews REST Route
The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from that role.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
EmbedPress (WordPress plugin)to a version that resolves this vulnerability.Fixed in 4.6.4
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with the Contributor role or a higher-privileged role can access the affected Google Reviews REST route. Unauthenticated visitors are not described as able to exploit it.
Which installations are affected?
Installations running EmbedPress versions 4.6.0 through 4.6.3 are affected. The issue is fixed in version 4.6.4.
What information can be exposed?
An attacker can read the site administrator's email address through the improperly restricted REST route. WordPress core normally withholds this value from Contributor-level users.