CVE-2026-84936: CWE-284 Improper Access Control in EmbedPress

CVE-2026-84936 is an improper access control vulnerability (CWE-284) in the EmbedPress WordPress plugin before version 4.6.4. The plugin does not properly authorize access to a public review-loading action, enabling unauthenticated attackers to force the affected site to make repeated billable API requests to third-party services using the site's configured API key. Additionally, attackers can create an unbounded number of rows in the site's database, potentially leading to resource exhaustion. No official patch or remediation level is currently documented.

The vulnerability allows unauthenticated attackers to abuse the site's API key for repeated billable third-party API requests, potentially incurring unexpected costs. It also enables attackers to create unlimited database entries, which could degrade site performance or cause denial of service due to resource exhaustion. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected review-loading action if possible or implement rate limiting to mitigate abuse. Monitor for unusual API usage patterns to detect exploitation attempts.