# Smart Showcase for Google Reviews <= 1.0.8 - Unauthenticated Missing Authorization to Google Account Connection Takeover via OAuth Callback

- **ID:** WPSEC-2026-3139
- **Plugin:** Smart Showcase for Google Reviews (`smart-showcase-for-google-reviews`), https://wordpress.org/plugins/smart-showcase-for-google-reviews/
- **Affected versions:** all versions before 1.0.9
- **Fixed in:** 1.0.9 (Update to 1.0.9 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/smart-showcase-for-google-reviews
- **Fix released:** 2026-11-13
- **Published:** 2026-11-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3139/

## Description

The Smart Showcase for Google Reviews plugin for WordPress is vulnerable to unauthorized modification of data via the Google OAuth callback in all versions up to, and including, 1.0.8, due to a missing capability check and a missing OAuth state check in the zwssgr_handle_auth_code() function, which runs on admin_init. This makes it possible for unauthenticated attackers to overwrite the stored Google connection email. With a valid authorization code they can also replace the stored JWT token, create widget posts and connect the site to a Google Business account they control. The zwssgr_fetch_oauth_url AJAX action also lacked a capability check, so any authenticated user could start the connection flow.

## References

- https://wpsec.com/vuln/WPSEC-2026-3139/
- https://plugins.svn.wordpress.org/smart-showcase-for-google-reviews/tags/1.0.9/
- https://wordpress.org/plugins/smart-showcase-for-google-reviews/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3139/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.