Widgets for Reviews & Recommendations <= 14.3 - Missing Authorization to Unauthenticated Information Exposure via REST API Routes and AJAX Widget Listing
- ID
- WPSEC-2026-3100
- Plugin
- Widgets for Reviews & Recommendations (free-facebook-reviews-and-recommendations-widgets)
- Affected
- all versions before 15.0
- Remediation
- Update to 15.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-13
- Attack surface
- Widgets for Reviews & Recommendations on WPSec AttackSurface
- Fix released
- Published
Description
The Widgets for Reviews & Recommendations plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 14.3, due to missing capability checks on the trustindex/v1/get-widgets and trustindex/v1/setup-complete REST API routes, which used a permission_callback of __return_true, and on the list_trustindex_widgets AJAX action. This makes it possible for unauthenticated attackers to retrieve the widget list of the connected Trustindex account and the plugin's setup state through the REST routes, and for authenticated attackers with subscriber-level access and above to list the widgets through the AJAX action.
References
- https://wpsec.com/vuln/WPSEC-2026-3100/
- https://plugins.svn.wordpress.org/free-facebook-reviews-and-recommendations-widgets/tags/15.0/
- https://wordpress.org/plugins/free-facebook-reviews-and-recommendations-widgets/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS