# Rich Showcase for Google Reviews <= 7.1.6 - Authenticated (Contributor+) Sensitive Information Exposure via Widget Builder Page

- **ID:** WPSEC-2026-1204
- **Plugin:** Rich Showcase for Google Reviews (`widget-google-reviews`), https://wordpress.org/plugins/widget-google-reviews/
- **Affected versions:** all versions before 7.1.7
- **Fixed in:** 7.1.7 (Update to 7.1.7 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin High, affected versions Medium (as of 2026-10-17)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/widget-google-reviews
- **Fix released:** 2026-10-16
- **Published:** 2026-10-17
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1204/

## Description

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure via the widget builder page in all versions up to, and including, 7.1.6, due to the builder page being registered with the edit_posts capability and printing the site-wide secret auth code (grw_auth_code) into inline JavaScript for every user who can open it. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the site's secret auth code, which the plugin sends to the RichPlugins connection service to identify the site when Google places are connected.

## References

- https://wpsec.com/vuln/WPSEC-2026-1204/
- https://plugins.svn.wordpress.org/widget-google-reviews/tags/7.1.7/
- https://wordpress.org/plugins/widget-google-reviews/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1204/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.