Skip to main content

EmbedPress CVE-2026-84936

| EUVDEUVD-2026-71875 MEDIUM
Improper Access Control (CWE-284)
2026-09-05 WPScan GHSA-5cvh-x6xg-5fhw
WordPress Authentication Bypass Embedpress Unknown
5.3
CVSS 3.1 · Vendor: WPScan
Share

Severity by source

Vendor (WPScan) PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
vuln.today AI
6.5 MEDIUM

Network-accessible unauthenticated endpoint (AV:N/PR:N); I:L for DB row injection; A:L added for API quota exhaustion and database bloat potential.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

5
Analysis Generated
Sep 06, 2026 - 11:39 vuln.today
CVSS changed
Sep 06, 2026 - 11:22 NVD
5.3 (MEDIUM)
Patch available
Sep 05, 2026 - 08:01 EUVD
CVE Published
Sep 05, 2026 - 06:00 cve.org
UNKNOWN (no severity yet)
CVE Published
Sep 05, 2026 - 06:00 cve.org
MEDIUM 5.3

DescriptionCVE.org

The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounded number of attacker-controlled rows in the database.

AnalysisAI

Missing authorization on the EmbedPress WordPress plugin's review-loading action (versions 4.6.0-4.6.3) permits unauthenticated remote attackers to abuse the site's stored third-party API credentials - triggering repeated billable API calls against the site owner's account - while simultaneously injecting an unbounded number of attacker-controlled rows into the WordPress database. A publicly available PoC exploit was documented by WPScan. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires no authentication, no elevated network position, and no user interaction - the vulnerable action handler is reachable by any unauthenticated HTTP client over the internet. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 5.3 Medium score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) correctly reflects the low-barrier, unauthenticated network vector, but understates the operational impact: repeated API calls drain the site operator's billing quota and can exhaust service rate limits, while unchecked database row creation risks bloating the WordPress database. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Update EmbedPress to version 4.6.4 or later; this vendor-released patch adds proper authorization controls to the review-loading action per the WPScan advisory at https://wpscan.com/vulnerability/bd708c98-1657-423b-aa2b-14aa18307c03/. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Embedpress

View all
CVE-2023-5750 MEDIUM POC
6.1 Dec 11

The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape a parameter before outputting it back in the p
CVE-2023-5749 MEDIUM POC
6.1 Dec 11

The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape user input before outputting it back in the pa
CVE-2026-10526 MEDIUM POC
5.8 Aug 04

Blind Server-Side Request Forgery in the EmbedPress WordPress plugin (all versions before 4.6.1) allows unauthenticated

CVE-2024-43328 CRITICAL
9.8 Aug 19

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPDeveloper EmbedPress a
CVE-2024-31284 CRITICAL
9.8 Jun 09

Missing Authorization vulnerability in WPDeveloper EmbedPress.9.8. Rated critical severity (CVSS 9.8), this vulnerabilit
CVE-2024-38707 HIGH
8.8 Nov 01

Missing Authorization vulnerability in WPDeveloper EmbedPress allows Exploiting Incorrectly Configured Access Control Se
CVE-2026-48872 HIGH
7.5 Jun 15

Unauthenticated sensitive data exposure in the EmbedPress WordPress plugin (versions 4.5.2 and earlier) allows remote at
CVE-2026-61961 HIGH
7.1 Aug 06

Unauthenticated reflected Cross-Site Scripting (XSS) in the EmbedPress WordPress plugin affects all versions up to and i
CVE-2026-84926 LOW POC
2.7 Sep 05

Information disclosure in the EmbedPress WordPress plugin (versions 4.6.0 through 4.6.3) allows any authenticated contri
CVE-2026-84927 LOW POC
2.7 Sep 05

Insufficient authorization on the EmbedPress WordPress plugin's Google Reviews REST API endpoint allows any authenticate
CVE-2024-1425 MEDIUM
6.4 Feb 29

The EmbedPress - Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elem
CVE-2024-50461 MEDIUM
6.5 Oct 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper EmbedP

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-84936 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy