# Widgets for Reviews & Recommendations <= 14.3 - Missing Authorization to Unauthenticated Information Exposure via REST API Routes and AJAX Widget Listing

- **ID:** WPSEC-2026-3100
- **Plugin:** Widgets for Reviews & Recommendations (`free-facebook-reviews-and-recommendations-widgets`), https://wordpress.org/plugins/free-facebook-reviews-and-recommendations-widgets/
- **Affected versions:** all versions before 15.0
- **Fixed in:** 15.0 (Update to 15.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/free-facebook-reviews-and-recommendations-widgets
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3100/

## Description

The Widgets for Reviews & Recommendations plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 14.3, due to missing capability checks on the trustindex/v1/get-widgets and trustindex/v1/setup-complete REST API routes, which used a permission_callback of __return_true, and on the list_trustindex_widgets AJAX action. This makes it possible for unauthenticated attackers to retrieve the widget list of the connected Trustindex account and the plugin's setup state through the REST routes, and for authenticated attackers with subscriber-level access and above to list the widgets through the AJAX action.

## References

- https://wpsec.com/vuln/WPSEC-2026-3100/
- https://plugins.svn.wordpress.org/free-facebook-reviews-and-recommendations-widgets/tags/15.0/
- https://wordpress.org/plugins/free-facebook-reviews-and-recommendations-widgets/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3100/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.