Executive brief
Site Kit by Google is a popular WordPress plugin that connects websites to Google services like Analytics and Search Console. A security flaw allows users with lower-level permissions (such as Editors) to change site-wide plugin settings that should be restricted to Administrators. While this does not allow for full site takeover, it enables unauthorized users to disable or modify features like email reporting and dashboard sharing configurations.
Technical details
An authorization bypass exists in the Site Kit by Google plugin's REST API implementation. The 'email-reporting' write endpoint incorrectly validates permissions by accepting the 'googlesitekit_view_dashboard' capability (often held by Editors via Dashboard Sharing) instead of requiring 'manage_options' (Administrator). An authenticated attacker with Editor-level access can send a crafted POST request to '/wp-json/google-site-kit/v1/core/site/data/email-reporting' to modify site-wide configuration settings. This issue is fixed in version 1.176.0 by enforcing stricter capability checks on the affected endpoint.
Affected products
- Google Site Kit by Google < 1.176.0
Timeline
- 2026-06-03: disclosed: Publicly published by WPScan
- 2026-06-24: advisory: CVE published to NVD