The WordPress plugin WP Google Review Slider, prior to version 18.11, does not verify a nonce when an administrator updates the active Google Places configuration. This omission permits an attacker to send a forged request that can modify or delete the Google API settings for the site. The vulnerability enables unauthorized alteration of how the plugin interacts with Google’s API, potentially leading to incorrect display of reviews or disabling the review functionality. The impact is on the integrity of the site’s configuration rather than direct code execution or data exposure.

The affected product is the WP Google Review Slider WordPress plugin. All installations running any version earlier than 18.11 are vulnerable. There is no vendor name other than the plugin itself, and no other products are mentioned.

The vulnerability can be exploited via a Cross-Site Request Forgery (CSRF) attack; the attacker must convince a site administrator to click a crafted link or submit a forged form. EPSS data is unavailable and the vulnerability is not listed in CISA KEV, suggesting a modest level of exploitation likelihood. The absence of a CSRF token means the attack requires user interaction, which lowers risk compared to more autonomous exploits. However, because the exposure modifies critical configuration settings, the potential impact to the site’s operation is significant for compromised sites. The CVSS score is not provided, so the severity cannot be quantified precisely from the supplied data.