{"id":"CVE-2026-117588","kind":"vulnerability","aliases":["CVE-2026-117588"],"related":[],"title":"WP Google Review Slider plugin: forged requests can alter Google Places configuration","description":"The WP Google Review Slider WordPress plugin before 18.11 does not perform nonce validation when updating its active Google Places configuration, allowing attackers to alter or destroy that configuration via a forged request, provided they can trick a site administrator into following a crafted link.","summary":"The WP Google Review Slider WordPress plugin before 18.11 does not check a nonce when saving its active Google Places configuration. An attacker who tricks a site administrator into opening a crafted link can change or destroy that configuration.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["google-reviews","package","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","version-18.11-or-later"],"how_to_check":"- Check the installed version of the WP Google Review Slider plugin in the WordPress admin Plugins screen, or `wp plugin get <plugin-slug>` if WP-CLI is used.\n- Confirm whether the installed version is below `18.11`.","fix":"- WP Google Review Slider: `18.11`","status":"open","published_at":"2026-11-07T06:16:57+00:00","first_seen_at":"2026-11-07T06:46:03+00:00","triaged_at":"2026-11-07T06:48:33+00:00","updated_at":"2026-11-07T06:48:33+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-07T06:48:33Z","model":"claude-haiku-5-5","output":{"fix":"- WP Google Review Slider: `18.11`","reach":"internet","title":"WP Google Review Slider plugin: forged requests can alter Google Places configuration","impact":"low","summary":"The WP Google Review Slider WordPress plugin before 18.11 does not check a nonce when saving its active Google Places configuration. An attacker who tricks a site administrator into opening a crafted link can change or destroy that configuration.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","google-reviews"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker alters or destroys the plugin's Google Places configuration","analyst_note":"","how_to_check":"- Check the installed version of the WP Google Review Slider plugin in the WordPress admin Plugins screen, or `wp plugin get <plugin-slug>` if WP-CLI is used.\n- Confirm whether the installed version is below `18.11`.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-18.11-or-later"],"who_is_affected":"Sites running the WP Google Review Slider plugin older than 18.11 are exposed. The attack needs a logged-in site administrator to follow a crafted link, so sites that do not use this plugin can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000676,"input_tokens":4205,"output_tokens":511,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117588':15A,18A '-2026':14A,17A '18.11':35B,74C 'activ':44B,83C 'administr':54B,105C 'allow':87C 'alter':9A,90C 'attack':49B,88C 'chang':61B 'check':38B 'configur':12A,47B,65B,86C,94C 'craft':58B,109C 'cve':13A,16A 'destroy':63B,92C 'follow':107C 'forg':6A,97C 'googl':2A,10A,20B,29B,45B,68C,84C 'google-review':19B 'link':59B,110C 'nonc':40B,78C 'open':56B 'packag':22B 'perform':77C 'place':11A,46B,85C 'plugin':5A,26B,33B,72C 'provid':99C 'request':7A,98C 'review':3A,21B,30B,69C 'save':42B 'site':53B,104C 'slider':4A,31B,70C 'trick':51B,102C 'updat':81C 'valid':79C 'via':95C 'wordpress':23B,25B,32B,71C 'wordpress-plugin':24B 'wp':1A,28B,67C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Google Review Slider plugin older than 18.11 are exposed. The attack needs a logged-in site administrator to follow a crafted link, so sites that do not use this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["googlereviews","medium","package","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-117588':15A,18A '-2026':14A,17A 'alter':9A 'configur':12A 'cve':13A,16A 'forg':6A 'googl':2A,10A 'place':11A 'plugin':5A 'request':7A 'review':3A 'slider':4A 'wp':1A","search_b":"'18.11':35B 'activ':44B 'administr':54B 'attack':49B 'chang':61B 'check':38B 'configur':47B,65B 'craft':58B 'destroy':63B 'googl':20B,29B,45B 'google-review':19B 'link':59B 'nonc':40B 'open':56B 'packag':22B 'place':46B 'plugin':26B,33B 'review':21B,30B 'save':42B 'site':53B 'slider':31B 'trick':51B 'wordpress':23B,25B,32B 'wordpress-plugin':24B 'wp':28B","search_c":"'18.11':74C 'activ':83C 'administr':105C 'allow':87C 'alter':90C 'attack':88C 'configur':86C,94C 'craft':109C 'destroy':92C 'follow':107C 'forg':97C 'googl':68C,84C 'link':110C 'nonc':78C 'perform':77C 'place':85C 'plugin':72C 'provid':99C 'request':98C 'review':69C 'site':104C 'slider':70C 'trick':102C 'updat':81C 'valid':79C 'via':95C 'wordpress':71C 'wp':67C","first_public_at":"2026-11-07T06:16:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117588","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117588","severity":null,"published_at":"2026-11-07T06:16:57+00:00","modified_at":"2026-11-07T06:16:57+00:00","first_seen_at":"2026-11-07T06:46:03+00:00","fetched_at":"2026-11-07T06:46:03+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}