CVE-2026-66428 Overview
CVE-2026-66428 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability affecting the WP Google Review Slider WordPress plugin in versions 18.4 and earlier. The flaw is classified under CWE-352 and allows attackers to trick authenticated users into submitting unintended requests to a vulnerable WordPress site. Successful exploitation requires user interaction, such as clicking a crafted link or visiting an attacker-controlled page while authenticated to the target site. The vulnerability affects site integrity but does not compromise confidentiality or availability directly.
Critical Impact
An unauthenticated attacker can leverage social engineering to force an authenticated WordPress user to perform plugin state changes without consent, resulting in limited integrity impact on affected sites.
Affected Products
- WP Google Review Slider plugin (also known as WP Google Places Review Slider)
- All versions up to and including 18.4
- WordPress sites with the vulnerable plugin installed and active
Discovery Timeline
- 2026-07-27 - CVE-2026-66428 published to NVD
- 2026-07-27 - Last updated in NVD database
Technical Details for CVE-2026-66428
Vulnerability Analysis
The vulnerability stems from missing or improperly validated anti-CSRF tokens in one or more plugin endpoints of WP Google Review Slider. WordPress plugins should validate incoming state-changing requests using nonces generated by wp_create_nonce() and validated with check_admin_referer() or wp_verify_nonce(). When these checks are absent, any authenticated session can be abused by cross-origin requests originating from attacker-controlled pages.
The attacker does not need credentials to the target site. Instead, the attack relies on an already-authenticated administrator or privileged user visiting a malicious page. The browser automatically attaches the WordPress session cookie to the forged request. The plugin then processes the request as if it originated from a legitimate user action.
The scope is unchanged and the impact is limited to integrity, with no direct data disclosure or denial of service.
Root Cause
The root cause is a missing CSRF protection mechanism on plugin request handlers that modify state. Without server-side validation of a nonce or origin, the plugin cannot distinguish between a legitimate administrator action and a forged cross-site request.
Attack Vector
Exploitation requires network access to the target WordPress site and user interaction. An attacker crafts an HTML page or email containing a form or image tag targeting a vulnerable plugin endpoint. When an authenticated WordPress user with the required capability loads the malicious content, the browser issues the state-changing request using the victim's session. See the Patchstack advisory for technical details on the affected endpoints.
Detection Methods for CVE-2026-66428
Indicators of Compromise
- Unexpected changes to WP Google Review Slider plugin settings, review data, or shortcode configurations without corresponding administrator activity.
- HTTP referer headers in WordPress access logs pointing to external, untrusted origins for plugin admin endpoints.
- POST requests to plugin AJAX or admin-post handlers lacking a valid _wpnonce parameter.
Detection Strategies
- Review WordPress audit logs for plugin configuration changes correlated with administrator browsing activity to external sites.
- Inspect web server access logs for cross-origin POST requests to /wp-admin/admin-ajax.php or /wp-admin/admin-post.php targeting plugin actions.
- Deploy a Web Application Firewall (WAF) rule to flag state-changing requests missing anti-CSRF tokens.
Monitoring Recommendations
- Enable a WordPress activity logging plugin to capture user, IP, and referer for all administrator actions.
- Alert on plugin settings modifications occurring outside expected maintenance windows.
- Monitor authentication sessions for administrators accessing the WordPress dashboard alongside browsing to unknown external domains.
How to Mitigate CVE-2026-66428
Immediate Actions Required
- Update the WP Google Review Slider plugin to the latest patched release beyond version 18.4 as published by the vendor.
- Audit WordPress administrator accounts and remove unused privileged users to reduce the exploit surface.
- Instruct administrators to log out of WordPress sessions when not actively managing the site.
Patch Information
Refer to the Patchstack WordPress Vulnerability Report for the fixed version details and vendor remediation guidance. Apply the plugin update through the WordPress plugin manager or by replacing the plugin files directly.
Workarounds
- Deactivate the WP Google Review Slider plugin until the patched version is applied.
- Enforce SameSite cookie attributes at the WordPress or reverse-proxy layer to reduce cross-site request success.
- Deploy a WAF ruleset that requires valid Referer and Origin headers for /wp-admin/ state-changing requests.
# Configuration example: WP-CLI plugin update and deactivation
wp plugin update wp-google-places-review-slider
wp plugin deactivate wp-google-places-review-slider # temporary workaround
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
