Nonce Validation Flaw in WP Google Review Slider Plugin by WordPress
CVE-2026-117588
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 7 November 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-117588?
The WP Google Review Slider plugin for WordPress does not implement nonce validation when updating the active Google Places configuration. This lack of validation allows malicious actors to send forged requests that can alter or remove the site's Google Places settings, potentially leading to unauthorized modifications. Attackers can exploit this vulnerability by tricking an administrator into clicking on specially crafted links.
Affected Version(s)
WP Google Review Slider 0 < 18.11
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.