# Google Review Slider <= 18.10 - Cross-Site Request Forgery to Google Places Configuration Update

- **ID:** WPSEC-2026-2519
- **Plugin:** WP Google Review Slider (`wp-google-places-review-slider`), https://wordpress.org/plugins/wp-google-places-review-slider/
- **Affected versions:** from 14.7 before 18.11
- **Fixed in:** 18.11 (Update to 18.11 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-352
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-google-places-review-slider
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2519/

## Description

The WP Google Review Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery via the Google Places API settings page ('ract=edit' and 'settings-updated' parameters) in all versions up to, and including, 18.10, due to missing nonce validation before the page writes the active and saved Google Places configuration options. This makes it possible for unauthenticated attackers to switch the active Google Places configuration to another saved location, or blank it by supplying an unknown place ID, and to rewrite the stored multi-location configuration via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.

## References

- https://wpsec.com/vuln/WPSEC-2026-2519/
- https://plugins.svn.wordpress.org/wp-google-places-review-slider/tags/18.11/
- https://wordpress.org/plugins/wp-google-places-review-slider/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2519/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.