# Post to Google My Business (Google Business Profile) <= 3.4.4 - Authenticated (Subscriber+) Missing Authorization to Freemius Opt-In

- **ID:** WPSEC-2026-1460
- **Plugin:** Post to Google My Business (Google Business Profile) (`post-to-google-my-business`), https://wordpress.org/plugins/post-to-google-my-business/
- **Affected versions:** all versions before 3.5.4
- **Fixed in:** 3.5.4 (Update to 3.5.4 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-22)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/post-to-google-my-business
- **Fix released:** 2026-10-21
- **Published:** 2026-10-22
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1460/

## Description

The Post to Google My Business (Google Business Profile) plugin for WordPress is vulnerable to unauthorized access via the bundled Freemius SDK's _install_with_new_user() opt-in handler in all versions up to, and including, 3.4.4, due to a missing capability check. The handler runs during admin_menu on any wp-admin page, and its nonce check is commented out. This makes it possible for authenticated attackers, with Subscriber-level access and above, to complete the Freemius opt-in for a site that is not yet connected. The attacker supplies the user and install identifiers and keys, which links the site's Freemius install to an account the attacker controls, or puts the site into a pending activation confirmation state for an email address the attacker chooses.

## References

- https://wpsec.com/vuln/WPSEC-2026-1460/
- https://plugins.svn.wordpress.org/post-to-google-my-business/tags/3.5.4/
- https://wordpress.org/plugins/post-to-google-my-business/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1460/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.