Google Review Slider <= 18.10 - Cross-Site Request Forgery to Google Places Configuration Update
- ID
- WPSEC-2026-2519
- Plugin
- WP Google Review Slider (wp-google-places-review-slider)
- Affected
- from 14.7 before 18.11
- Remediation
- Update to 18.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- Weakness
- CWE-352
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-04
- Attack surface
- Google Review Slider on WPSec AttackSurface
- Fix released
- Published
Description
The WP Google Review Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery via the Google Places API settings page ('ract=edit' and 'settings-updated' parameters) in all versions up to, and including, 18.10, due to missing nonce validation before the page writes the active and saved Google Places configuration options. This makes it possible for unauthenticated attackers to switch the active Google Places configuration to another saved location, or blank it by supplying an unknown place ID, and to rewrite the stored multi-location configuration via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
References
- https://wpsec.com/vuln/WPSEC-2026-2519/
- https://plugins.svn.wordpress.org/wp-google-places-review-slider/tags/18.11/
- https://wordpress.org/plugins/wp-google-places-review-slider/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS