{
 "id": "WPSEC-2026-3139",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3139/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3139/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3139/index.md",
 "title": "Smart Showcase for Google Reviews <= 1.0.8 - Unauthenticated Missing Authorization to Google Account Connection Takeover via OAuth Callback",
 "description": "The Smart Showcase for Google Reviews plugin for WordPress is vulnerable to unauthorized modification of data via the Google OAuth callback in all versions up to, and including, 1.0.8, due to a missing capability check and a missing OAuth state check in the zwssgr_handle_auth_code() function, which runs on admin_init. This makes it possible for unauthenticated attackers to overwrite the stored Google connection email. With a valid authorization code they can also replace the stored JWT token, create widget posts and connect the site to a Google Business account they control. The zwssgr_fetch_oauth_url AJAX action also lacked a capability check, so any authenticated user could start the connection flow.",
 "plugin": {
  "slug": "smart-showcase-for-google-reviews",
  "name": "Smart Showcase for Google Reviews",
  "full_name": "Smart Showcase for Google Reviews",
  "wordpress_org": "https://wordpress.org/plugins/smart-showcase-for-google-reviews/",
  "advisories_url": "https://wpsec.com/vuln/plugin/smart-showcase-for-google-reviews/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/smart-showcase-for-google-reviews"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.0.9",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.0.9"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.0.9",
 "remediation": "Update to 1.0.9 or later.",
 "fix_released": "2026-11-13T10:19:11+00:00",
 "published": "2026-11-14T10:41:09+00:00",
 "updated": "2026-11-13T15:55:21.687997+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3139/",
  "https://plugins.svn.wordpress.org/smart-showcase-for-google-reviews/tags/1.0.9/",
  "https://wordpress.org/plugins/smart-showcase-for-google-reviews/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/smart-showcase-for-google-reviews",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-14"
 }
}