CVE-2026-84936

Name of the Vulnerable Software and Affected Versions EmbedPress versions 4.6.0 through 4.6.3

Description Lack of proper authorization on a public review-loading action allows unauthenticated or low-privileged users to trigger repeated billable third-party API requests using the site's configured API key. This issue occurs because the GET and POST handlers of the /google-reviews/places REST endpoint were gated only on edit posts or remained entirely open instead of requiring manage options permissions. Consequently, an attacker can force the site to make these API calls and insert an unbounded number of attacker-controlled rows into the database, leading to a Denial of Service.

Recommendations Update EmbedPress to version 4.6.4 or later. Restrict access to the /google-reviews/places REST endpoint as a temporary mitigation.