THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-84927 (LOW 2.7) — The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting

[NVD] CVE-2026-84927 (LOW 2.7) — The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting

mednvdPublished 2026-09-05

CVE-2026-84927 CVSS: 2.7 LOW Published: 2026-09-05T07:17:14.410

The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which are rendered publicly across the site

Indicators of compromise

CVE-2026-84927cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-84927