{"id":"CVE-2026-110020","kind":"vulnerability","aliases":["CVE-2026-110020"],"related":[],"title":"WordPress Rich Showcase Google Reviews plugin: contributors can steal site auth secret","description":"The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.1.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve the plugin's 127-character site-wide grw_auth_code authentication secret and use it to impersonate the WordPress site to the RichPlugins backend service at app.richplugins.com.","summary":"The Rich Showcase for Google Reviews WordPress plugin, up to and including 7.1.6, does not check authorization on an action that returns its site-wide grw_auth_code secret. An authenticated user with contributor access or above can read that secret and use it to impersonate the site to the vendor's app.richplugins.com backend.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","trusted-users-only"],"how_to_check":"- Check the installed plugin version in the WordPress admin plugins list or `wp plugin get rich-showcase-google-reviews --field=version` (slug assumed; confirm it)\n- Review user accounts with contributor role or above on the site","fix":"- Update the Rich Showcase for Google Reviews plugin to a version newer than `7.1.6`\n- Rotate the grw_auth_code value if the site ran a vulnerable version with untrusted contributor accounts","status":"open","published_at":"2026-10-28T07:16:45+00:00","first_seen_at":"2026-10-28T07:31:38+00:00","triaged_at":"2026-10-28T07:32:54+00:00","updated_at":"2026-10-28T07:32:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T07:32:54Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Rich Showcase for Google Reviews plugin to a version newer than `7.1.6`\n- Rotate the grw_auth_code value if the site ran a vulnerable version with untrusted contributor accounts","reach":"internet","title":"WordPress Rich Showcase Google Reviews plugin: contributors can steal site auth secret","impact":"medium","summary":"The Rich Showcase for Google Reviews WordPress plugin, up to and including 7.1.6, does not check authorization on an action that returns its site-wide grw_auth_code secret. An authenticated user with contributor access or above can read that secret and use it to impersonate the site to the vendor's app.richplugins.com backend.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker steals site secret and impersonates the WordPress site to vendor backend","analyst_note":"Find the fixed plugin version and confirm the plugin slug from the NVD entry or the WordPress.org plugin page.","how_to_check":"- Check the installed plugin version in the WordPress admin plugins list or `wp plugin get rich-showcase-google-reviews --field=version` (slug assumed; confirm it)\n- Review user accounts with contributor role or above on the site","needs_analyst":true,"not_affected_if":["plugin-not-installed","trusted-users-only"],"who_is_affected":"Sites running the Rich Showcase for Google Reviews plugin at version 7.1.6 or earlier are exposed, and the risk depends on having accounts at contributor level or above that are not fully trusted. Sites that do not run this plugin can skip it. The sources do not say which patched version fixes it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000663,"input_tokens":3392,"output_tokens":647,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110020':15A,18A '-2026':14A,17A '127':141C '7.1.6':39B,103C 'access':62B,133C 'action':46B,121C 'app.richplugins.com':80B,165C 'attack':128C 'auth':11A,54B,147C 'authent':58B,127C,149C 'author':43B,94C,117C 'backend':81B,162C 'bypass':95C 'charact':142C 'check':42B 'code':55B,148C 'contributor':7A,61B,131C 'contributor-level':130C 'cve':13A,16A 'due':106C 'googl':4A,31B,86C 'grw':53B,146C 'host':22B 'imperson':73B,155C 'includ':38B,102C 'level':132C 'make':123C 'packag':19B 'perform':119C 'plugin':6A,26B,34B,88C,109C,139C 'possibl':125C 'proper':111C 'read':66B 'retriev':137C 'return':48B 'review':5A,32B,87C 'rich':2A,28B,83C 'richplugin':161C 'secret':12A,56B,68B,150C 'self':21B 'self-host':20B 'servic':163C 'showcas':3A,29B,84C 'site':10A,51B,75B,144C,158C 'site-wid':50B,143C 'steal':9A 'use':70B,152C 'user':59B,115C 'vendor':78B 'verifi':112C 'version':98C 'vulner':92C 'wide':52B,145C 'wordpress':1A,23B,25B,33B,90C,157C 'wordpress-plugin':24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Rich Showcase for Google Reviews plugin at version 7.1.6 or earlier are exposed, and the risk depends on having accounts at contributor level or above that are not fully trusted. Sites that do not run this plugin can skip it. The sources do not say which patched version fixes it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T07:16:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110020","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110020","severity":null,"published_at":"2026-10-28T07:16:45+00:00","modified_at":"2026-10-28T07:16:45+00:00","first_seen_at":"2026-10-28T07:31:38+00:00","fetched_at":"2026-10-28T07:31:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}