{
 "id": "WPSEC-2026-1460",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1460/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1460/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1460/index.md",
 "title": "Post to Google My Business (Google Business Profile) <= 3.4.4 - Authenticated (Subscriber+) Missing Authorization to Freemius Opt-In",
 "description": "The Post to Google My Business (Google Business Profile) plugin for WordPress is vulnerable to unauthorized access via the bundled Freemius SDK's _install_with_new_user() opt-in handler in all versions up to, and including, 3.4.4, due to a missing capability check. The handler runs during admin_menu on any wp-admin page, and its nonce check is commented out. This makes it possible for authenticated attackers, with Subscriber-level access and above, to complete the Freemius opt-in for a site that is not yet connected. The attacker supplies the user and install identifiers and keys, which links the site's Freemius install to an account the attacker controls, or puts the site into a pending activation confirmation state for an email address the attacker chooses.",
 "plugin": {
  "slug": "post-to-google-my-business",
  "name": "Post to Google My Business (Google Business Profile)",
  "full_name": "Post to Google My Business (Google Business Profile)",
  "wordpress_org": "https://wordpress.org/plugins/post-to-google-my-business/",
  "advisories_url": "https://wpsec.com/vuln/plugin/post-to-google-my-business/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/post-to-google-my-business"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.5.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.5.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.5.4",
 "remediation": "Update to 3.5.4 or later.",
 "fix_released": "2026-10-21T14:21:30+00:00",
 "published": "2026-10-22T14:52:34+00:00",
 "updated": "2026-10-22T09:33:19.596514+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1460/",
  "https://plugins.svn.wordpress.org/post-to-google-my-business/tags/3.5.4/",
  "https://wordpress.org/plugins/post-to-google-my-business/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/post-to-google-my-business",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-22"
 }
}