---
id: "CVE-2026-117588"
page: "https://infrastack.ai/live/CVE-2026-117588"
kind: "vulnerability"
aliases: ["CVE-2026-117588"]
title: "WP Google Review Slider plugin: forged requests can alter Google Places configuration"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["google-reviews", "package", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed", "version-18.11-or-later"]
published_at: "2026-11-07T06:16:57+00:00"
first_seen_at: "2026-11-07T06:46:03+00:00"
updated_at: "2026-11-07T06:48:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117588", "first_seen_at": "2026-11-07T06:46:03+00:00"}]
exploit_sources: []
---

# WP Google Review Slider plugin: forged requests can alter Google Places configuration

Link for people: https://infrastack.ai/live/CVE-2026-117588 (this .md is for agents)

The WP Google Review Slider WordPress plugin before 18.11 does not check a nonce when saving its active Google Places configuration. An attacker who tricks a site administrator into opening a crafted link can change or destroy that configuration.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the WP Google Review Slider plugin in the WordPress admin Plugins screen, or `wp plugin get <plugin-slug>` if WP-CLI is used.
- Confirm whether the installed version is below `18.11`.

## Fix

- WP Google Review Slider: `18.11`

## Timeline

- 2026-11-07T06:46:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117588

## From the sources

The WP Google Review Slider WordPress plugin before 18.11 does not perform nonce validation when updating its active Google Places configuration, allowing attackers to alter or destroy that configuration via a forged request, provided they can trick a site administrator into following a crafted link.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_