Site Kit by Google CVE-2026-62139

Exploitation requires that the target WordPress site runs Site Kit by Google plugin version 1.186.0 or earlier. The victim must be simultaneously authenticated to the WordPress admin interface (holding a valid session cookie) and must visit an attacker-controlled page or click a crafted link - passive exposure is insufficient. The attacker has no authentication requirement on their side. The exploitable action is limited to what the vulnerable CSRF-unprotected endpoint permits, which based on I:L impact is a low-severity state change (e.g., modifying plugin settings) rather than full compromise. Non-WordPress deployments are unaffected; sites with the plugin disabled or removed are not vulnerable.

The CVSS 3.1 base score of 4.3 (Medium) accurately reflects limited real-world severity: integrity impact is low (I:L), there is no confidentiality or availability impact, and user interaction is mandatory (UI:R). No KEV listing and no public POC are present, and the EPSS signal is absent from available data. The attack requires successfully luring a logged-in WordPress administrator or privileged editor to a malicious page or click a crafted link - a meaningful social engineering barrier. While the attacker needs no prior authentication themselves (PR:N), the dependency on an authenticated victim session substantially limits opportunistic or automated exploitation. The primary realistic concern is targeted abuse in contexts where the attacker can deliver a convincing lure to a site admin, potentially to alter Google service configurations (Analytics property, Search Console verification, AdSense connection). The Patchstack advisory provides the reference basis; no independent vendor advisory from Google/WordPress.org has been confirmed in the available data.

An attacker crafts a malicious web page containing a hidden form or img tag that submits a forged request to the Site Kit plugin's unprotected endpoint. The attacker then delivers a phishing link to the site's WordPress administrator; when the admin loads the page while their browser holds a valid WordPress session cookie, the forged request executes with the admin's privileges - potentially disconnecting a Google Analytics property, altering Search Console settings, or modifying AdSense configuration without the admin's knowledge. No public POC has been identified at time of analysis, so exploitation requires manual crafting of the forged payload by the attacker.