# Widgets for Reviews & Recommendations <= 14.3 - Unauthenticated Uncontrolled Resource Consumption via Online Visitor Counter

- **ID:** WPSEC-2026-3099
- **Plugin:** Widgets for Reviews & Recommendations (`free-facebook-reviews-and-recommendations-widgets`), https://wordpress.org/plugins/free-facebook-reviews-and-recommendations-widgets/
- **Affected versions:** from 13.2 before 15.0
- **Fixed in:** 15.0 (Update to 15.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
- **Weakness:** CWE-770
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/free-facebook-reviews-and-recommendations-widgets
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3099/

## Description

The Widgets for Reviews & Recommendations plugin for WordPress is vulnerable to uncontrolled resource consumption via the online visitor counter endpoint in all versions up to, and including, 14.3, due to the getOnlineUsers() function creating a new database option for every distinct 'p' parameter value and a new transient for every IP address and user agent, with no limit on how many are created. The only check is a nonce that is printed on every front-end page. This makes it possible for unauthenticated attackers to fill the wp_options table with any number of rows, which degrades site performance.

## References

- https://wpsec.com/vuln/WPSEC-2026-3099/
- https://plugins.svn.wordpress.org/free-facebook-reviews-and-recommendations-widgets/tags/15.0/
- https://wordpress.org/plugins/free-facebook-reviews-and-recommendations-widgets/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3099/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.