Executive brief
Site Kit by Google is a WordPress plugin that connects WordPress sites to Google services for analytics and indexing. An unauthenticated cross-site request forgery (CSRF) vulnerability in versions up to 1.186.0 allows attackers to trick logged-in administrators into performing unintended actions, such as changing plugin settings or modifying site configuration, by visiting malicious websites.
Technical details
The vulnerability is a cross-site request forgery (CSRF) affecting Site Kit by Google WordPress plugin versions 1.186.0 and earlier. The flaw allows unauthenticated attackers to craft malicious requests that, when clicked or visited by a logged-in administrator, execute unintended actions within the plugin without proper CSRF token validation. While exploitation requires user interaction (an admin must visit a crafted link or page), successful attacks can result in unauthorized changes to plugin configuration or site settings. The vulnerability has been patched in version 1.187.0.
Affected products
- Google Site Kit <= 1.186.0
Timeline
- 2026-09-11: disclosed
- 2026-09-10: patched: Version 1.187.0