CVE-2026-84936 EmbedPress 4.6.0 - 4.6.3 - Unauthenticated Google Reviews API Quota Consumption and Database Bloat

The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounded number of...

CVE-2026-84936

The EmbedPress WordPress plugin (versions 4.6.0–4.6.3 ) has a missing-authorization flaw on a public review-loading action. An unauthenticated attacker can force the site to issue repeated billable third-party API requests using the site's own configured API key and to write an unbounded number o...

WordPress EmbedPress plugin 4.6.0-4.6.3 - Unauthenticated Google Reviews API Quota Consumption and Database Bloat vulnerability

Unauthenticated Google Reviews API Quota Consumption and Database Bloat vulnerability discovered by RIA Labs in WordPress Plugin EmbedPress versions 4.6.0-4.6.3...