THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-84926 (LOW 2.7) — The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress co

[NVD] CVE-2026-84926 (LOW 2.7) — The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress co

mednvdPublished 2026-09-05

CVE-2026-84926 CVSS: 2.7 LOW Published: 2026-09-05T07:17:14.317

The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from that role.

Indicators of compromise

CVE-2026-84926cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-84926