Site Kit By Google
Monthly
Cross-site request forgery in Site Kit by Google WordPress plugin version 1.186.0 and earlier allows an unauthenticated remote attacker to perform unauthorized actions on behalf of authenticated site administrators or editors. The flaw (CWE-352) exists because the plugin fails to properly validate request origin tokens, enabling forged state-changing requests to succeed when an authenticated victim interacts with attacker-controlled content. No public exploit has been identified at time of analysis, and real-world impact is constrained by the UI:R requirement - a legitimate privileged user must be socially engineered into triggering the request.
Insufficient REST API authorization in the Site Kit by Google WordPress plugin before version 1.176.0 permits users with dashboard sharing access - such as those granted the Editor role - to write to a site-wide settings endpoint that should be restricted to administrators. The integrity impact is confined to plugin-level configuration, but the flaw is significant because dashboard sharing is commonly granted to non-admin contributors on multi-author sites. A publicly available proof-of-concept exists per WPScan; exploitation probability remains very low (EPSS 0.13%, 3rd percentile) and the vulnerability is not listed in the CISA KEV catalog.
Cross-site request forgery in Site Kit by Google WordPress plugin version 1.186.0 and earlier allows an unauthenticated remote attacker to perform unauthorized actions on behalf of authenticated site administrators or editors. The flaw (CWE-352) exists because the plugin fails to properly validate request origin tokens, enabling forged state-changing requests to succeed when an authenticated victim interacts with attacker-controlled content. No public exploit has been identified at time of analysis, and real-world impact is constrained by the UI:R requirement - a legitimate privileged user must be socially engineered into triggering the request.
Insufficient REST API authorization in the Site Kit by Google WordPress plugin before version 1.176.0 permits users with dashboard sharing access - such as those granted the Editor role - to write to a site-wide settings endpoint that should be restricted to administrators. The integrity impact is confined to plugin-level configuration, but the flaw is significant because dashboard sharing is commonly granted to non-admin contributors on multi-author sites. A publicly available proof-of-concept exists per WPScan; exploitation probability remains very low (EPSS 0.13%, 3rd percentile) and the vulnerability is not listed in the CISA KEV catalog.