{
 "id": "WPSEC-2026-3100",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3100/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3100/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3100/index.md",
 "title": "Widgets for Reviews & Recommendations <= 14.3 - Missing Authorization to Unauthenticated Information Exposure via REST API Routes and AJAX Widget Listing",
 "description": "The Widgets for Reviews & Recommendations plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 14.3, due to missing capability checks on the trustindex/v1/get-widgets and trustindex/v1/setup-complete REST API routes, which used a permission_callback of __return_true, and on the list_trustindex_widgets AJAX action. This makes it possible for unauthenticated attackers to retrieve the widget list of the connected Trustindex account and the plugin's setup state through the REST routes, and for authenticated attackers with subscriber-level access and above to list the widgets through the AJAX action.",
 "plugin": {
  "slug": "free-facebook-reviews-and-recommendations-widgets",
  "name": "Widgets for Reviews & Recommendations",
  "full_name": "Widgets for Reviews & Recommendations",
  "wordpress_org": "https://wordpress.org/plugins/free-facebook-reviews-and-recommendations-widgets/",
  "advisories_url": "https://wpsec.com/vuln/plugin/free-facebook-reviews-and-recommendations-widgets/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/free-facebook-reviews-and-recommendations-widgets"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "15.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 15.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "15.0",
 "remediation": "Update to 15.0 or later.",
 "fix_released": "2026-11-12T17:21:41+00:00",
 "published": "2026-11-13T17:41:06+00:00",
 "updated": "2026-11-13T15:54:27.179752+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3100/",
  "https://plugins.svn.wordpress.org/free-facebook-reviews-and-recommendations-widgets/tags/15.0/",
  "https://wordpress.org/plugins/free-facebook-reviews-and-recommendations-widgets/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/free-facebook-reviews-and-recommendations-widgets",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-13"
 }
}