{
 "id": "WPSEC-2026-3093",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3093/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3093/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3093/index.md",
 "title": "Widgets for Google Reviews <= 14.3 - Unauthenticated Uncontrolled Resource Consumption via Online Visitors Tracking",
 "description": "The Widgets for Google Reviews plugin for WordPress is vulnerable to uncontrolled resource consumption via the online visitors tracking endpoint in all versions up to, and including, 14.3, due to the plugin storing a separate database option for every attacker-supplied page value, and a transient for every IP address and user agent pair, with no limit. This makes it possible for unauthenticated attackers to cause unbounded growth of the wp_options table, potentially degrading site performance.",
 "plugin": {
  "slug": "wp-reviews-plugin-for-google",
  "name": "Widgets for Google Reviews",
  "full_name": "Widgets for Google Reviews",
  "wordpress_org": "https://wordpress.org/plugins/wp-reviews-plugin-for-google/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-reviews-plugin-for-google/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-reviews-plugin-for-google"
 },
 "type": "DOS",
 "cwe": [
  "CWE-400"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "13.2",
    "from_inclusive": true,
    "to": "15.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 13.2 before 15.0"
  ]
 },
 "introduced_in": "13.2",
 "fixed_in": "15.0",
 "remediation": "Update to 15.0 or later.",
 "fix_released": "2026-11-12T16:33:37+00:00",
 "published": "2026-11-13T16:44:01+00:00",
 "updated": "2026-11-13T15:53:44.031263+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3093/",
  "https://plugins.svn.wordpress.org/wp-reviews-plugin-for-google/tags/15.0/",
  "https://wordpress.org/plugins/wp-reviews-plugin-for-google/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-reviews-plugin-for-google",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-13"
 }
}