What is the CVSS score of CVE-2026-10753?

CVE-2026-10753 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-10753?

Yes, a public proof-of-concept exploit is available for CVE-2026-10753. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-10753?

Yes, a patch is available for CVE-2026-10753. Update the affected software to the latest version immediately.

Site Kit by Google CVE-2026-10753

EUVD-2026-38695 LOW

2026-06-24 WPScan

GHSA-8rqq-v4wf-9qrm

WordPress Information Disclosure Google Site Kit By Google Unknown

2.7

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

2.7 LOW

Requires explicit dashboard sharing grant (Editor-equivalent privilege, PR:H); only low integrity impact on plugin settings; no confidentiality or availability impact applies.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 14:23 vuln.today

CVSS changed

Jun 24, 2026 - 14:22 NVD

2.7 (LOW)

Patch available

Jun 24, 2026 - 08:16 EUVD

CVE Published

Jun 24, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 24, 2026 - 06:00 cve.org

LOW 2.7

DescriptionCVE.org

The Site Kit by Google WordPress plugin before 1.176.0 does not properly restrict a REST API write endpoint to administrators, allowing lower-privileged users who have been granted dashboard sharing access (such as Editors) to modify a site-wide Site Kit by Google WordPress plugin before 1.176.0 setting that should only be modifiable by administrators.

AnalysisAI

Insufficient REST API authorization in the Site Kit by Google WordPress plugin before version 1.176.0 permits users with dashboard sharing access - such as those granted the Editor role - to write to a site-wide settings endpoint that should be restricted to administrators. The integrity impact is confined to plugin-level configuration, but the flaw is significant because dashboard sharing is commonly granted to non-admin contributors on multi-author sites. A publicly available proof-of-concept exists per WPScan; exploitation probability remains very low (EPSS 0.13%, 3rd percentile) and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Site Kit by Google is the official Google-published WordPress plugin that connects a site to Google services including Search Console, Analytics, AdSense, and PageSpeed Insights. It exposes REST API endpoints for administrative operations. The flaw is a missing or insufficient capability check on a write endpoint - conceptually aligned with CWE-862 (Missing Authorization) - where the plugin fails to enforce that only users with the WordPress 'manage_options' or equivalent administrator capability can modify the site-wide setting in question. CWE is listed as N/A in the NVD entry, but the description clearly indicates an authorization enforcement gap on a REST route. The affected CPE is cpe:2.3:a:unknown:site_kit_by_google:*:*:*:*:*:*:*:* covering all versions below 1.176.0.

RemediationAI

Update the Site Kit by Google WordPress plugin to version 1.176.0 or later; this is the vendor-released patch confirmed by WPScan (https://wpscan.com/vulnerability/824a5c04-c7d6-4286-a499-48452db4d002/). If an immediate upgrade is not feasible, the most effective compensating control is to revoke or minimize dashboard sharing grants: remove Editor-level dashboard sharing access from any untrusted users until the patch is applied, since the vulnerability is only exploitable by users who have been explicitly granted that access. Disabling the plugin entirely is a more disruptive alternative that fully removes the attack surface but breaks Google service integrations. There is no known server-side WAF rule that can reliably block this specific REST endpoint misuse without also blocking legitimate admin traffic to the same endpoint.