Smart Showcase for Google Reviews <= 1.0.8 - Unauthenticated Missing Authorization to Google Account Connection Takeover via OAuth Callback
- ID
- WPSEC-2026-3139
- Plugin
- Smart Showcase for Google Reviews (smart-showcase-for-google-reviews)
- Affected
- all versions before 1.0.9
- Remediation
- Update to 1.0.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-14
- Attack surface
- Smart Showcase for Google Reviews on WPSec AttackSurface
- Fix released
- Published
Description
The Smart Showcase for Google Reviews plugin for WordPress is vulnerable to unauthorized modification of data via the Google OAuth callback in all versions up to, and including, 1.0.8, due to a missing capability check and a missing OAuth state check in the zwssgr_handle_auth_code() function, which runs on admin_init. This makes it possible for unauthenticated attackers to overwrite the stored Google connection email. With a valid authorization code they can also replace the stored JWT token, create widget posts and connect the site to a Google Business account they control. The zwssgr_fetch_oauth_url AJAX action also lacked a capability check, so any authenticated user could start the connection flow.
References
- https://wpsec.com/vuln/WPSEC-2026-3139/
- https://plugins.svn.wordpress.org/smart-showcase-for-google-reviews/tags/1.0.9/
- https://wordpress.org/plugins/smart-showcase-for-google-reviews/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS