Rich Showcase EUVD-2026-111748

Exploitation requires an authenticated WordPress account with contributor-level privileges or above on a site running Rich Showcase for Google Reviews ≤7.1.6 (consistent with PR:L). The specific condition is that the plugin performs a sensitive action - exposing the site-wide grw_auth_code authentication secret - without verifying the caller is authorized (CWE-862), so any contributor can retrieve a secret intended only for administrators. Limiting factors: the attacker must already possess valid low-privilege credentials on the target site (so purely unauthenticated attackers cannot exploit it), and the practical payoff is bounded by whatever the RichPlugins backend (app.richplugins.com) permits once the site is impersonated - the input does not specify the exact plugin action/endpoint beyond the referenced builder/admin-menu source files.

This is a moderate-priority information-disclosure issue, not a critical emergency. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) is internally consistent: network-reachable, low complexity, but requiring authenticated contributor-level access (PR:L), with impact limited to confidentiality (C:H; I:N/A:N). The CWE-862 (missing authorization) classification matches the description's claim that the plugin fails to verify a user's authorization before exposing the 127-character site-wide grw_auth_code secret. The vuln.today decision label is 'this_month' - a routine patch-cycle priority, not 'act_now' or 'emergency.' No EPSS score, no CISA KEV listing, and no public exploit code were provided in the input, so there is no signal of active or widespread exploitation. The main caveat is scope of impact: C:H reflects leakage of a credential that lets an attacker impersonate the site to the RichPlugins backend (app.richplugins.com), but the real-world consequence depends on what that backend session permits - the input does not describe what an attacker can do after impersonation, so the downstream blast radius is unverified. The contributor-level prerequisite meaningfully limits risk: the attacker must already hold a (low-privilege) account on the target WordPress site.

An attacker who holds a contributor-level (or higher) account on a WordPress site running the plugin invokes the under-protected plugin action and reads back the site-wide grw_auth_code secret, which they are not authorized to see. They then replay that 127-character secret against app.richplugins.com to impersonate the victim site to the RichPlugins backend service. No public exploit code was identified in the provided data.