# Widgets for Google Reviews <= 14.3 - Missing Authorization to Unauthenticated Trustindex Widget List Exposure via REST API

- **ID:** WPSEC-2026-3092
- **Plugin:** Widgets for Google Reviews (`wp-reviews-plugin-for-google`), https://wordpress.org/plugins/wp-reviews-plugin-for-google/
- **Affected versions:** all versions before 15.0
- **Fixed in:** 15.0 (Update to 15.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-reviews-plugin-for-google
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3092/

## Description

The Widgets for Google Reviews plugin for WordPress is vulnerable to unauthorized access of data via the trustindex/v1/get-widgets and trustindex/v1/setup-complete REST API routes in all versions up to, and including, 14.3, due to a permission callback that always returns true (and a missing capability check on the list_trustindex_widgets AJAX action). This makes it possible for unauthenticated attackers to retrieve the names and IDs of the widgets saved in the connected Trustindex account and the widget setup status of the site.

## References

- https://wpsec.com/vuln/WPSEC-2026-3092/
- https://plugins.svn.wordpress.org/wp-reviews-plugin-for-google/tags/15.0/
- https://wordpress.org/plugins/wp-reviews-plugin-for-google/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3092/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.