Rich Showcase for Google Reviews <= 7.1.6 - Authenticated (Contributor+) Sensitive Information Exposure via Widget Builder Page
- ID
- WPSEC-2026-1204
- Plugin
- Rich Showcase for Google Reviews (widget-google-reviews)
- Affected
- all versions before 7.1.7
- Remediation
- Update to 7.1.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-17
- Attack surface
- Rich Showcase for Google Reviews on WPSec AttackSurface
- Fix released
- Published
Description
The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure via the widget builder page in all versions up to, and including, 7.1.6, due to the builder page being registered with the edit_posts capability and printing the site-wide secret auth code (grw_auth_code) into inline JavaScript for every user who can open it. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the site's secret auth code, which the plugin sends to the RichPlugins connection service to identify the site when Google places are connected.
References
- https://wpsec.com/vuln/WPSEC-2026-1204/
- https://plugins.svn.wordpress.org/widget-google-reviews/tags/7.1.7/
- https://wordpress.org/plugins/widget-google-reviews/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS