CVE-2026-117588: WP Google Review Slider < 18.11 - Google API Settings Update via CSRF

Q: Who can be targeted by this issue?

Sites using WP Google Review Slider versions before 18.11 are affected if a site administrator can be induced to follow a crafted link while authenticated.

Q: What can an attacker change?

An attacker can alter or destroy the plugin's active Google Places configuration through a forged request. The issue affects updates to the active Google Places settings.

Q: Does exploitation require access to the WordPress administration area?

The attacker does not need to be an administrator, but exploitation requires tricking an authenticated site administrator into following a crafted link.

Published Nov 7, 2026

Updated

The WP Google Review Slider WordPress plugin before 18.11 does not perform nonce validation when updating its active Google Places configuration, allowing attackers to alter or destroy that configuration via a forged request, provided they can trick a site administrator into following a crafted link.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WP Google Review Slider to a version that resolves this vulnerability.
Fixed in 18.11

Event History

Nov 7, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Frequently Asked Questions

Who can be targeted by this issue?

Sites using WP Google Review Slider versions before 18.11 are affected if a site administrator can be induced to follow a crafted link while authenticated.

What can an attacker change?

An attacker can alter or destroy the plugin's active Google Places configuration through a forged request. The issue affects updates to the active Google Places settings.

Does exploitation require access to the WordPress administration area?

The attacker does not need to be an administrator, but exploitation requires tricking an authenticated site administrator into following a crafted link.

CVE-2026-117588: WP Google Review Slider < 18.11 - Google API Settings Update via CSRF

Remediation

Event History

Frequently Asked Questions

Who can be targeted by this issue?

What can an attacker change?

Does exploitation require access to the WordPress administration area?

Company

Resources

Contact

Frequently Asked Questions

Who can be targeted by this issue?

What can an attacker change?

Does exploitation require access to the WordPress administration area?