CVE-2026-117588 · Package
NO FIX YET · SEE WHAT TO DO
The WP Google Review Slider WordPress plugin before 18.11 does not check a nonce when saving its active Google Places configuration. An attacker who tricks a site administrator into opening a crafted link can change or destroy that configuration.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the WP Google Review Slider plugin older than 18.11 are exposed. The attack needs a logged-in site administrator to follow a crafted link, so sites that do not use this plugin can skip it.
Not affected if plugin-not-installed, version-18.11-or-later
Who cares google-reviews, wordpress, wordpress-plugin
wp plugin get <plugin-slug> if WP-CLI is used.18.11.18.11The WP Google Review Slider WordPress plugin before 18.11 does not perform nonce validation when updating its active Google Places configuration, allowing attackers to alter or destroy that configuration via a forged request, provided they can trick a site administrator into following a crafted link.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.