Description

Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-11T19:17:45.393Z",
  "pubdate": "2026-09-11T19:17:45.393Z",
  "executiveSummary": "The Site Kit by Google plugin for WordPress is affected by an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability in versions up to and including 1.186.0.\nThis security flaw allows an unauthenticated, remote attacker to trick an authenticated administrator into executing unintended actions via their browser session.\nThe vulnerability arises from a lack of sufficient nonce validation or CSRF protection mechanisms on sensitive plugin functions.\nSuccessful exploitation can lead to unauthorized configuration changes, potential service disruption, or the manipulation of plugin settings.\nBecause the attack relies on the victim's authenticated state, the impact is highly dependent on the privileges of the target user, typically a site administrator.\nNo direct user interaction, other than the victim navigating to a malicious link or interacting with a crafted webpage, is required.\nThe risk is categorized as significant due to the widespread deployment of the Site Kit plugin and the potential for privilege escalation or unauthorized data modification.\nUsers are advised to limit administrative access and monitor plugin configurations while awaiting security updates.",
  "technicalDetails": "The vulnerability is rooted in the failure of the Site Kit by Google codebase to implement robust Cross-Site Request Forgery (CSRF) defenses across its administrative action endpoints.\nIn versions 1.186.0 and earlier, specific plugin operations do not consistently verify the presence or validity of cryptographically secure nonces or other state-changing protection tokens when processing incoming requests.\nAn unauthenticated attacker can construct a malicious HTTP request—often encapsulated within an HTML document or a concealed script—that targets a sensitive administrative function within the Site Kit ecosystem.\nWhen an administrator, currently authenticated into the WordPress dashboard, interacts with the attacker's content (e.g., clicking a link or loading a malicious page), the browser automatically includes the victim's session cookies with the forged request.\nThe target server, recognizing the valid session cookies, processes the forged request as a legitimate instruction from the administrator. Because the server lacks CSRF protection on the specific endpoint, it executes the payload without verifying the request's origin.\nThe attack flow proceeds as follows: 1) The attacker crafts a request designed to modify specific plugin settings or initiate an administrative action; 2) The attacker baits an authenticated administrator into executing this request via the victim's active session; 3) The server receives the request, associates it with the victim's session, and executes the state-changing operation; 4) The plugin configuration is altered to the attacker's specification.\nThis flaw effectively bypasses authentication protocols by leveraging the victim's existing session, granting the attacker the ability to perform actions within the plugin's context without needing the victim's credentials.\nThe impact is determined by the specific functions exposed through the unauthenticated endpoints. If the affected components manage sensitive API keys, site connection settings, or data collection parameters, the attacker could redirect analytics data, disable reporting, or compromise the integrity of the Site Kit configuration.\nPost-exploitation, the attacker may maintain persistence if the vulnerability allows for the modification of settings that weaken the overall security posture of the WordPress installation or the connected Google services."
}