The plugin’s feature request form saves uploaded attachments into the WordPress uploads directory without checking the file type, so a logged-in user with Editor access or higher can upload a PHP file and run code on the server. Widgets for Google Reviews 11.0.2 and older are affected.
This vulnerability affects the following application versions:
- Widgets for Google Reviews 10.9.1