CVE-2026-84926
EmbedPress 4.6.0 - 4.6.3 - Contributor+ Administrator Email Disclosure via Google Reviews REST Route
LOW 2.7EPSS 0.3%
The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from that role.
- Affected
- EmbedPress
- CVSS v3.1 CNA
- 2.7 LOW
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - EPSS
- 0.32% chance of exploitation in the next 30 days, 23rd percentile
- Published
- 2026-09-05
- Updated
- 2026-09-06