Vulnerabilities / Widgets for Google Reviews / WPSEC-2026-3092
Widgets for Google Reviews <= 14.3 - Missing Authorization to Unauthenticated Trustindex Widget List Exposure via REST API
Medium 5.3
CWE-862Fixed in 15.0
- ID
- WPSEC-2026-3092
- Plugin
- Widgets for Google Reviews (wp-reviews-plugin-for-google)
- Affected
- all versions before 15.0
- Remediation
- Update to 15.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-13
- Attack surface
- Widgets for Google Reviews on WPSec AttackSurface
- Fix released
- Published
Description
The Widgets for Google Reviews plugin for WordPress is vulnerable to unauthorized access of data via the trustindex/v1/get-widgets and trustindex/v1/setup-complete REST API routes in all versions up to, and including, 14.3, due to a permission callback that always returns true (and a missing capability check on the list_trustindex_widgets AJAX action). This makes it possible for unauthenticated attackers to retrieve the names and IDs of the widgets saved in the connected Trustindex account and the widget setup status of the site.
References
- https://wpsec.com/vuln/WPSEC-2026-3092/
- https://plugins.svn.wordpress.org/wp-reviews-plugin-for-google/tags/15.0/
- https://wordpress.org/plugins/wp-reviews-plugin-for-google/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS