---
id: "CVE-2026-110020"
kind: "vulnerability"
aliases: ["CVE-2026-110020"]
title: "WordPress Rich Showcase Google Reviews plugin: contributors can steal site auth secret"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed", "trusted-users-only"]
published_at: "2026-10-28T07:16:45+00:00"
first_seen_at: "2026-10-28T07:31:38+00:00"
updated_at: "2026-10-28T07:32:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110020", "first_seen_at": "2026-10-28T07:31:38+00:00"}]
---

# WordPress Rich Showcase Google Reviews plugin: contributors can steal site auth secret

The Rich Showcase for Google Reviews WordPress plugin, up to and including 7.1.6, does not check authorization on an action that returns its site-wide grw_auth_code secret. An authenticated user with contributor access or above can read that secret and use it to impersonate the site to the vendor's app.richplugins.com backend.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin plugins list or `wp plugin get rich-showcase-google-reviews --field=version` (slug assumed; confirm it)
- Review user accounts with contributor role or above on the site

## Fix

- Update the Rich Showcase for Google Reviews plugin to a version newer than `7.1.6`
- Rotate the grw_auth_code value if the site ran a vulnerable version with untrusted contributor accounts

## Timeline

- 2026-10-28T07:31:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110020

## From the sources

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.1.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve the plugin's 127-character site-wide grw_auth_code authentication secret and use it to impersonate the WordPress site to the RichPlugins backend service at app.richplugins.com.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_