Plugin for Google Reviews <= 7.1 - Unauthenticated Sensitive Information Exposure via Business Photo URL
- ID
- WPSEC-2026-0192
- Plugin
- Rich Showcase for Google Reviews (widget-google-reviews)
- Affected
- from 6.9.5 before 7.1.1
- Remediation
- Update to 7.1.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Plugin for Google Reviews on WPSec AttackSurface
- Fix released
- Published
Description
The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 6.9.5 up to, and including, 7.1 due to the plugin storing the Google Places photo request URL, which includes the site's Google API key, as the business photo when downloading that photo fails, and rendering it in the public reviews widget and badge. This makes it possible for unauthenticated attackers to obtain the site's Google API key from the page source of pages displaying the reviews, which can be abused to consume the site owner's API quota. Exploitation requires that the site uses its own Google API key and that a place photo download failed.
References
- https://wpsec.com/vuln/WPSEC-2026-0192/
- https://plugins.svn.wordpress.org/widget-google-reviews/tags/7.1.1/
- https://wordpress.org/plugins/widget-google-reviews/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS