Post to Google My Business (Google Business Profile) <= 3.4.4 - Authenticated (Subscriber+) Missing Authorization to Freemius Opt-In
- ID
- WPSEC-2026-1460
- Plugin
- Post to Google My Business (Google Business Profile) (post-to-google-my-business)
- Affected
- all versions before 3.5.4
- Remediation
- Update to 3.5.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Post to Google My Business (Google Business Profile) on WPSec AttackSurface
- Fix released
- Published
Description
The Post to Google My Business (Google Business Profile) plugin for WordPress is vulnerable to unauthorized access via the bundled Freemius SDK's _install_with_new_user() opt-in handler in all versions up to, and including, 3.4.4, due to a missing capability check. The handler runs during admin_menu on any wp-admin page, and its nonce check is commented out. This makes it possible for authenticated attackers, with Subscriber-level access and above, to complete the Freemius opt-in for a site that is not yet connected. The attacker supplies the user and install identifiers and keys, which links the site's Freemius install to an account the attacker controls, or puts the site into a pending activation confirmation state for an email address the attacker chooses.
References
- https://wpsec.com/vuln/WPSEC-2026-1460/
- https://plugins.svn.wordpress.org/post-to-google-my-business/tags/3.5.4/
- https://wordpress.org/plugins/post-to-google-my-business/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS