Site Kit by Google – Analytics, Search Console, AdSense, Speed, CVE-2026-10753
- CVE, Research URL
- Home page URL
-
Security reports for Site Kit by Google – Analytics, Search Console, AdSense, Speed
- Published on
- Jun 24, 2026
- Research Description
- The Site Kit by Google WordPress plugin before 1.176.0 does not properly restrict a REST API write endpoint to administrators, allowing lower-privileged users who have been granted dashboard sharing access (such as Editors) to modify a site-wide Site Kit by Google WordPress plugin before 1.176.0 setting that should only be modifiable by administrators.
- Affected versions
-
max 1.176.0.
- Status
-
vulnerable