Authorization Bypass in Rich Showcase for Google Reviews Plugin by WordPress

CVE-2026-110020

What is CVE-2026-110020?

The Rich Showcase for Google Reviews plugin for WordPress is susceptible to an authorization bypass due to inadequate user verification for action execution. This vulnerability allows authenticated attackers with contributor-level access and higher to access the site's grw_auth_code, a 127-character authentication secret. Once obtained, this code can be exploited to impersonate the WordPress site to the RichPlugins backend service, posing significant risks to site integrity and user information.

References