EUVD-2026-71870
GHSA-6rmc-pw7c-rvpw
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Contributor is a low-privilege WordPress role mapping to PR:L, not PR:H; no confidentiality or availability impact from review store manipulation.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which are rendered publicly across the site.
AnalysisAI
Insufficient authorization on the EmbedPress WordPress plugin's Google Reviews REST API endpoint allows any authenticated Contributor-role user to overwrite the site-wide reviews store in versions 4.6.0 through 4.6.3. An attacker with a Contributor account can delete administrator-configured review entries and inject fabricated ones that render publicly across the entire WordPress site, enabling reputation manipulation or social engineering. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold an active WordPress account with at least the Contributor role on the target site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N, score 2.7) contains a metric inconsistency: PR:H denotes high-privilege (administrator-level) access, yet the description explicitly states that Contributor-role users - a low-privilege WordPress role - can exploit this. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update EmbedPress to version 4.6.4 or later via the WordPress admin plugin dashboard (Plugins > Installed Plugins > Update) or through the WordPress.org plugin repository; the patch introduces proper capability checks on the affected Google Reviews REST API endpoint per the WPScan advisory (https://wpscan.com/vulnerability/12984501-5d93-4941-9e12-6bb8049bd23d/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Embedpress
View allThe EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape a parameter before outputting it back in the p
The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape user input before outputting it back in the pa
Blind Server-Side Request Forgery in the EmbedPress WordPress plugin (all versions before 4.6.1) allows unauthenticated
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPDeveloper EmbedPress a
Missing Authorization vulnerability in WPDeveloper EmbedPress.9.8. Rated critical severity (CVSS 9.8), this vulnerabilit
Missing authorization on the EmbedPress WordPress plugin's review-loading action (versions 4.6.0-4.6.3) permits unauthen
Missing Authorization vulnerability in WPDeveloper EmbedPress allows Exploiting Incorrectly Configured Access Control Se
Unauthenticated sensitive data exposure in the EmbedPress WordPress plugin (versions 4.5.2 and earlier) allows remote at
Unauthenticated reflected Cross-Site Scripting (XSS) in the EmbedPress WordPress plugin affects all versions up to and i
Information disclosure in the EmbedPress WordPress plugin (versions 4.6.0 through 4.6.3) allows any authenticated contri
The EmbedPress - Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elem
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper EmbedP
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today