Live › vulnerability › CVE-2026-110020
Go to dashboardThe Rich Showcase for Google Reviews WordPress plugin, up to and including 7.1.6, does not check authorization on an action that returns its site-wide grw_auth_code secret. An authenticated user with contributor access or above can read that secret and use it to impersonate the site to the vendor's app.richplugins.com backend.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 07:31 UTC. All times on this page are UTC.
Sites running the Rich Showcase for Google Reviews plugin at version 7.1.6 or earlier are exposed, and the risk depends on having accounts at contributor level or above that are not fully trusted. Sites that do not run this plugin can skip it. The sources do not say which patched version fixes it.
No product ranges from the sources yet.
wp plugin get rich-showcase-google-reviews --field=version (slug assumed; confirm it)7.1.6Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.1.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve the plugin's 127-character site-wide grw_auth_code authentication secret and use it to impersonate the WordPress site to the RichPlugins backend service at app.richplugins.com.
This page as .md · .json · in your agent: get_signal("CVE-2026-110020")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.