CVE-2026-84927 Overview
CVE-2026-84927 is a missing authorization vulnerability [CWE-862] in the EmbedPress WordPress plugin versions prior to 4.6.4. The plugin fails to enforce sufficient authorization checks on one of its Google Reviews REST API routes. Authenticated users holding the Contributor role or higher can modify a site-wide review store. Attackers can delete entries configured by administrators and inject their own content, which then renders publicly across the site. The flaw affects site integrity by allowing low-privileged contributors to alter content displayed to all visitors.
Critical Impact
Contributor-level accounts can tamper with a site-wide Google Reviews store, replacing administrator-curated entries with attacker-controlled content displayed publicly.
Affected Products
- EmbedPress WordPress plugin versions prior to 4.6.4
Discovery Timeline
- 2026-09-05 - CVE-2026-84927 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-84927
Vulnerability Analysis
The EmbedPress plugin exposes a Google Reviews REST API route that manages a shared, site-wide data store of review entries. The route lacks a proper capability check to ensure only administrators can modify this store. Any authenticated user with the Contributor role or higher can call the endpoint and mutate its contents.
The practical impact is content integrity loss. An attacker with a low-privileged account can remove legitimate Google Reviews an administrator configured. The attacker can then inject arbitrary review entries that are subsequently rendered on public-facing pages served by the plugin.
This vulnerability aligns with CWE-862: Missing Authorization. Exploitation requires an authenticated account but no user interaction and can be performed over the network.
Root Cause
The root cause is a missing or insufficient permission_callback on the affected REST API route registered by the EmbedPress plugin. WordPress REST routes must validate the caller's capabilities before mutating persistent options or plugin-managed data. In vulnerable versions, the Google Reviews route accepts write operations from any authenticated user whose role meets the minimal edit_posts threshold used for Contributor accounts.
Attack Vector
An attacker first obtains or registers a WordPress account with Contributor privileges or higher. The attacker then sends an authenticated HTTP request to the vulnerable Google Reviews REST endpoint exposed by EmbedPress. The request modifies the site-wide review store, deleting existing administrator entries and injecting attacker-controlled ones. The injected reviews are then served to unauthenticated site visitors through pages that render the plugin's Google Reviews widget.
For technical specifics on the affected route, refer to the WPScan Vulnerability Report.
Detection Methods for CVE-2026-84927
Indicators of Compromise
- Unexpected changes to the EmbedPress Google Reviews configuration or option data in the wp_options table.
- Public pages rendering review entries that were not authored or approved by administrators.
- Authenticated REST API requests from Contributor-role accounts to EmbedPress Google Reviews routes.
Detection Strategies
- Review WordPress access logs for POST, PUT, or DELETE requests to /wp-json/ routes registered by the EmbedPress plugin, correlated to non-administrator user sessions.
- Compare the current Google Reviews store contents against a known-good administrator baseline to identify unauthorized mutations.
- Audit user role assignments to identify Contributor-or-higher accounts that should not exist or that have logged in from unusual locations.
Monitoring Recommendations
- Enable WordPress audit logging to capture REST API calls made by authenticated users, including request paths and originating account.
- Alert on modifications to plugin options associated with EmbedPress via database change detection.
- Track new Contributor, Author, or Editor account creation events and review self-registration settings.
How to Mitigate CVE-2026-84927
Immediate Actions Required
- Upgrade the EmbedPress plugin to version 4.6.4 or later on all WordPress sites where it is installed.
- Review the current Google Reviews store contents and restore any administrator-approved entries that may have been tampered with.
- Audit all user accounts with Contributor role or above and disable any that are unrecognized or inactive.
Patch Information
The vendor addressed the missing authorization check in EmbedPress version 4.6.4. The fix enforces an appropriate capability check on the Google Reviews REST API route so that only administrators can modify the site-wide store. Full details are documented in the WPScan Vulnerability Report.
Workarounds
- If immediate patching is not possible, temporarily deactivate the EmbedPress plugin until the update can be applied.
- Restrict Contributor and higher role assignments to trusted users only, and disable open user registration where feasible.
- Place a web application firewall rule in front of the site to block unauthenticated and low-privileged access to EmbedPress REST routes.
# Configuration example: WP-CLI commands to update EmbedPress and audit accounts
wp plugin update embedpress --version=4.6.4
wp user list --role=contributor --fields=ID,user_login,user_email,user_registered
wp option get embedpress_settings
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
