Reviews Widgets for Google, TripAdvisor, Yelp & Recommendations <= 2.9 - Authenticated (Contributor+) Sensitive Information Exposure via Feed Builder Page
- ID
- WPSEC-2026-2758
- Plugin
- Reviews Widgets for Google, TripAdvisor, Yelp & Recommendations (fb-reviews-widget)
- Affected
- from 2.0 before 2.9.1
- Remediation
- Update to 2.9.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-10
- Attack surface
- Reviews Widgets for Google, TripAdvisor, Yelp & Recommendations on WPSec AttackSurface
- Fix released
- Published
Description
The Reviews Widgets for Google, TripAdvisor, Yelp & Recommendations plugin for WordPress is vulnerable to Sensitive Information Exposure via the feed builder page in all versions up to, and including, 2.9. This is due to the builder page being accessible to users with the edit_posts capability while printing the stored feed configuration, including the Facebook page access tokens of connections, and the plugin's stored auth code without restricting them to administrators. This makes it possible for authenticated attackers, with Contributor-level access and above, to retrieve these secrets and potentially use them to access the connected Facebook pages or the plugin's connected service.
References
- https://wpsec.com/vuln/WPSEC-2026-2758/
- https://plugins.svn.wordpress.org/fb-reviews-widget/tags/2.9.1/
- https://wordpress.org/plugins/fb-reviews-widget/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS