CVE-2026-84926: EmbedPress WordPress Information Disclosure

CVE-2026-84926 Overview

CVE-2026-84926 is an information disclosure vulnerability in the EmbedPress WordPress plugin before version 4.6.4. The plugin fails to restrict access to one of its Google Reviews REST API routes to administrators. Any authenticated user holding contributor-level access or higher can query the endpoint and retrieve the site administrator's email address. WordPress core deliberately withholds this value from contributor roles, so the plugin reintroduces disclosure that the platform otherwise prevents. The weakness is tracked under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Authenticated low-privilege users can harvest the site administrator's email address, enabling targeted phishing and credential-stuffing campaigns against the highest-privileged WordPress account.

Affected Products

EmbedPress WordPress plugin versions prior to 4.6.4
WordPress sites permitting contributor-level or higher registrations
Multi-author WordPress deployments using EmbedPress Google Reviews features

Discovery Timeline

2026-09-05 - CVE-2026-84926 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-84926

Vulnerability Analysis

EmbedPress registers a REST API route to support its Google Reviews integration. The route's permission callback does not enforce an administrator capability check. Instead, it accepts any authenticated user session that satisfies a lower authorization bar. When a contributor, author, or editor queries the endpoint, the plugin returns response data that includes the administrator's email address.

WordPress core intentionally scopes access to admin_email and related identity fields. Only users with the manage_options capability, typically administrators, should read this value through core APIs. EmbedPress bypasses that boundary by exposing the value through its own route without matching the core capability check.

The disclosure is limited to a single sensitive field and requires authentication, which constrains direct impact. However, the administrator email is a high-value pivot for phishing, password reset abuse, and account enumeration against the WordPress admin account.

Root Cause

The root cause is a missing or insufficient permission callback on the affected Google Reviews REST route. The plugin relies on authentication alone rather than validating the caller's capability against manage_options. This is a classic broken access control pattern in WordPress REST endpoint registration.

Attack Vector

An attacker first obtains contributor-level credentials, either through legitimate registration on open-membership sites, credential compromise, or social engineering. The attacker then issues an authenticated HTTP request to the vulnerable EmbedPress REST route. The response contains the administrator email address. No user interaction from the victim is required, and no elevation of privilege on the WordPress site is needed beyond the initial contributor session.

See the WPScan Vulnerability Advisory for endpoint-level technical details.

Detection Methods for CVE-2026-84926

Indicators of Compromise

Authenticated REST API requests to EmbedPress Google Reviews routes originating from contributor, author, or editor accounts
Unexpected wp-json traffic patterns from low-privilege user sessions targeting plugin-specific namespaces
Increased phishing attempts directed at the site administrator email address following unusual contributor activity

Detection Strategies

Inspect web server and WordPress access logs for GET requests against EmbedPress REST namespaces where the authenticated user role is below administrator
Correlate low-privilege session identifiers with REST endpoint hits that return administrator metadata
Audit installed plugin versions across the estate and flag any EmbedPress installation below 4.6.4

Monitoring Recommendations

Enable REST API request logging with authenticated user context and role labels
Alert on any contributor-level account issuing requests to plugin-registered REST routes outside its normal editorial workflow
Track newly registered low-privilege accounts and monitor their first-week API activity for reconnaissance patterns

How to Mitigate CVE-2026-84926

Immediate Actions Required

Upgrade the EmbedPress plugin to version 4.6.4 or later on all WordPress sites
Audit existing contributor, author, and editor accounts and remove or disable unused low-privilege users
Rotate the site administrator email address if evidence of prior enumeration exists, and enable multi-factor authentication on the administrator account

Patch Information

The vendor addressed the issue in EmbedPress 4.6.4 by enforcing an administrator capability check on the affected Google Reviews REST route. Refer to the WPScan Vulnerability Advisory for the fixed version reference.

Workarounds

Disable the EmbedPress plugin until the upgrade to 4.6.4 or later can be completed
Restrict WordPress user registration and require administrator approval for any new contributor-level accounts
Place the /wp-json/ REST API behind an authenticated reverse proxy rule that blocks plugin-specific namespaces for non-administrator roles

bash

# Configuration example: block EmbedPress REST namespace for non-admins at the web tier
# Example nginx snippet - adjust namespace to match the vulnerable route
location ~* /wp-json/embedpress/ {
    if ($cookie_wordpress_logged_in_admin = "") {
        return 403;
    }
}