Site Kit by Google EUVD-2026-38695

Exploitation requires three concrete conditions: (1) the target WordPress site must be running Site Kit by Google plugin at a version below 1.176.0; (2) the attacker must already possess a WordPress account that has been explicitly granted dashboard sharing access by an administrator - this is a non-default configuration, as dashboard sharing must be actively enabled and delegated; (3) network access to the WordPress REST API (typically the /wp-json/ path). The primary limiting factor is condition (2): the attack pool is confined to users who an administrator has already trusted enough to share the Site Kit dashboard with. Unauthenticated attackers and standard Subscriber/Contributor roles without dashboard sharing cannot exploit this flaw. The integrity impact is also scoped to Site Kit plugin settings, not broader WordPress site configuration.

All available signals converge on low real-world risk. The NVD CVSS 3.1 base score is 2.7 (Low), driven by PR:H (the attacker must already hold dashboard sharing access, equivalent to an Editor or similarly privileged role), S:U (unchanged scope), no confidentiality or availability impact, and only low integrity impact. EPSS sits at 0.13% in the 3rd percentile, indicating the security community considers exploitation extremely unlikely. The vulnerability is not listed in the CISA KEV catalog. A POC is publicly available via WPScan, which slightly elevates opportunistic risk on unpatched sites with non-admin contributors; however, the prerequisite of pre-existing elevated access limits the attacker pool significantly. No conflict exists between CVSS vector and description - both consistently indicate network-reachable but privilege-gated exploitation. The 'Information Disclosure' tag in the source intelligence appears inconsistent with the description, which describes unauthorized setting modification (an integrity issue), not data leakage; security teams should not interpret this as a credential or data exfiltration risk.

An attacker who holds WordPress Editor access or has been granted Site Kit dashboard sharing by an administrator sends a crafted authenticated REST API request directly to the vulnerable write endpoint, bypassing the intended administrator-only restriction. This allows them to silently alter a site-wide Site Kit setting - such as a Google Analytics property ID or Search Console verification - potentially redirecting analytics data to an attacker-controlled Google account. A publicly available proof-of-concept from WPScan documents the exact endpoint and request structure.