The Rich Showcase for Google Reviews plugin is vulnerable to an authorization bypass that allows authenticated users with contributor-level privileges or higher to retrieve the 127-character grw_auth_code. Exposing this secret can let an attacker impersonate the WordPress site to the RichPlugins backend service, potentially enabling further compromise or data exfiltration. The weakness is an improper authorization check, classified as CWE-862. The impact is primarily confidentiality and integrity of the external service integration, and could serve as a pivot for additional attacks against the host.

WordPress sites running the Rich Showcase for Google Reviews plugin from WidgetPack, version 7.1.6 or earlier are affected. The vulnerability exists in the admin menu and builder page interfaces that do not verify user authorization before allowing access to the site secret.

The CVSS score of 6.5 indicates moderate severity. Exploitation requires only legitimate contributor or higher credentials; no further prerequisite for remote code execution is documented. EPSS is not available, and the vulnerability is not listed in CISA KEV. Attackers can exploit the flaw by navigating to the plugin's admin or builder interface and requesting the secret, which the plugin then exposes.