Threats tagged 'ghsa-w2f6-cjfj-3fhf'

The Rich Showcase for Google Reviews WordPress plugin up to version 7.1.6 contains an authorization bypass vulnerability. This flaw allows authenticated users with contributor-level access or higher to retrieve a sensitive site-wide authentication secret (grw_auth_code). The secret can be used to impersonate the WordPress site to the plugin's backend service, potentially leading to unauthorized actions. The vulnerability is identified as CVE-2026-110020 and has a CVSS score of 6.5 (medium severity).