CVE-2026-84936: EmbedPress 4.6.0 - 4.6.3 - Unauthenticated Google Reviews API Quota Consumption and Database Bloat
The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounded number of attacker-controlled rows in the database.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
EmbedPress (WordPress plugin)to a version that resolves this vulnerability.Fixed in 4.6.4 - Compensating control
Ensure only authorized/validated users can trigger public review-loading actions so unauthenticated requests cannot cause repeated billable third-party API calls using the site's configured API key.
Event History
Frequently Asked Questions
Which deployments are exposed to the third-party API cost risk?
EmbedPress versions before 4.6.4 are affected when the site has a Google Reviews integration configured with its own API key. Unauthenticated users can trigger repeated requests using that key.
Does an attacker need a WordPress account or other authentication?
No. The affected review-loading action is public and lacks proper authorization, so unauthenticated users can exploit it.
What impact can occur beyond third-party API usage?
An attacker can create an unbounded number of attacker-controlled database rows. This can cause database growth in addition to consumption of billable third-party API quota.
How can the issue be remediated?
Update EmbedPress to version 4.6.4 or later. The affected versions are 4.6.0 through 4.6.3.