{"id":"CVE-2026-84926","title":"The EmbedPress  WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administ…","summary":"The EmbedPress  WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administ…","severity":"low","cvss":2.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-200"],"published":"2026-09-05","updated":"2026-09-08","sourceUpdated":"2026-09-08T19:09:21.310","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84926","references":[{"url":"https://wpscan.com/vulnerability/5f1bc0f2-1112-4f75-b2b6-27498e43cd4b/","label":"contact@wpscan.com"}],"tags":["nvd"],"epss":0.00316,"epssPercentile":0.21776,"ingestedAt":"2026-09-06T06:51:17.667Z","slug":"CVE-2026-84926","body":"## Overview\n\nThe EmbedPress  WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from that role.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":15,"depthScoreParts":{"impact":14.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":8294,"id":"CVE-2026-84926","ts":1788919996133,"field":"cvss","old":null,"new":"2.7"},{"seq":8293,"id":"CVE-2026-84926","ts":1788919996133,"field":"severity","old":"none","new":"low"},{"seq":8103,"id":"CVE-2026-84926","ts":1788919281783,"field":"cvss","old":"2.7","new":null},{"seq":8102,"id":"CVE-2026-84926","ts":1788919281783,"field":"severity","old":"low","new":"none"},{"seq":7912,"id":"CVE-2026-84926","ts":1788916357351,"field":"cvss","old":null,"new":"2.7"},{"seq":7911,"id":"CVE-2026-84926","ts":1788916357351,"field":"severity","old":"none","new":"low"},{"seq":7721,"id":"CVE-2026-84926","ts":1788915298947,"field":"cvss","old":"2.7","new":null},{"seq":7720,"id":"CVE-2026-84926","ts":1788915298947,"field":"severity","old":"low","new":"none"},{"seq":7530,"id":"CVE-2026-84926","ts":1788912717864,"field":"cvss","old":null,"new":"2.7"},{"seq":7529,"id":"CVE-2026-84926","ts":1788912717864,"field":"severity","old":"none","new":"low"},{"seq":7339,"id":"CVE-2026-84926","ts":1788911331913,"field":"cvss","old":"2.7","new":null},{"seq":7338,"id":"CVE-2026-84926","ts":1788911331913,"field":"severity","old":"low","new":"none"},{"seq":7143,"id":"CVE-2026-84926","ts":1788909079473,"field":"cvss","old":null,"new":"2.7"},{"seq":7142,"id":"CVE-2026-84926","ts":1788909079473,"field":"severity","old":"none","new":"low"},{"seq":6955,"id":"CVE-2026-84926","ts":1788907391967,"field":"cvss","old":"2.7","new":null},{"seq":6954,"id":"CVE-2026-84926","ts":1788907391967,"field":"severity","old":"low","new":"none"},{"seq":6757,"id":"CVE-2026-84926","ts":1788905445331,"field":"cvss","old":null,"new":"2.7"},{"seq":6756,"id":"CVE-2026-84926","ts":1788905445331,"field":"severity","old":"none","new":"low"},{"seq":6575,"id":"CVE-2026-84926","ts":1788903460189,"field":"cvss","old":"2.7","new":null},{"seq":6574,"id":"CVE-2026-84926","ts":1788903460189,"field":"severity","old":"low","new":"none"},{"seq":6361,"id":"CVE-2026-84926","ts":1788901811378,"field":"cvss","old":null,"new":"2.7"},{"seq":6360,"id":"CVE-2026-84926","ts":1788901811378,"field":"severity","old":"none","new":"low"},{"seq":6191,"id":"CVE-2026-84926","ts":1788899562555,"field":"cvss","old":"2.7","new":null},{"seq":6190,"id":"CVE-2026-84926","ts":1788899562555,"field":"severity","old":"low","new":"none"},{"seq":6059,"id":"CVE-2026-84926","ts":1788898240578,"field":"cvss","old":null,"new":"2.7"},{"seq":6058,"id":"CVE-2026-84926","ts":1788898240578,"field":"severity","old":"none","new":"low"}]}