CVE-2026-10753: Site Kit by Google WordPress Plugin Privilege Escalation (CVSS 2.7)

Technical summary

CVE-2026-10753 is a privilege escalation flaw in the Site Kit by Google WordPress plugin (versions prior to 1.176.0). The vulnerability stems from insufficient authorization checks on a REST API write endpoint. Users with elevated but non-administrative roles—including Editors or those with dashboard sharing access—can bypass role restrictions to modify site-wide plugin configuration. The CVSS 3.1 score of 2.7 (LOW severity) reflects limited integrity impact with no confidentiality or availability consequences. The attack requires high privilege context (PR:H) and no user interaction, making exploitation straightforward for in-scope accounts but limited to those already granted elevated access.

Business impact

The primary risk is unauthorized modification of Site Kit plugin configuration by privileged-but-not-administrative users. This could disrupt intended plugin behavior, alter analytics tracking settings, affect API integrations with Google services, or introduce unintended functionality changes. The impact is contained to settings governance rather than data breach or service disruption, but it represents a loss of administrative control over plugin behavior. Organizations relying on strict role-based separation of duties may face compliance concerns if Editors or dashboard-sharing users can unilaterally reconfigure site-wide integrations.

Affected systems

WordPress installations running the Site Kit by Google plugin in any version prior to 1.176.0 are affected. The vulnerability only manifests if the site has granted dashboard sharing access or Editor-level roles to non-administrative users. Standalone WordPress sites, multisite networks, and managed WordPress hosting platforms using this plugin are all in scope. The threat is limited to installations where lower-privileged users have been intentionally granted elevated access.

Exploitability

Exploitation requires the attacker to already hold an Editor role or dashboard sharing permissions on the WordPress site. No authentication bypass is needed; the vulnerability is triggered from within an authenticated, authorized session. Exploitation is straightforward—a user with the appropriate role can directly invoke the vulnerable REST API endpoint to modify plugin settings. The attack requires no user interaction from administrators and no complex exploitation techniques. However, the attacker must be a legitimate user or gain legitimate access credentials first, which limits real-world risk in well-secured environments.

Remediation

Upgrade the Site Kit by Google plugin to version 1.176.0 or later. This version introduces proper authorization checks to restrict REST API write endpoints to administrators only. No workarounds are available prior to patching; the remediation is straightforward and requires a single plugin update through the WordPress admin dashboard or via automated update mechanisms.

Patch guidance

Update the Site Kit by Google WordPress plugin to version 1.176.0 or later. Administrators can apply the patch through WordPress Admin > Plugins > Updates, or configure automatic updates if not already enabled. Verify the updated version number in Plugins > Installed Plugins after patching. No database changes, configuration adjustments, or site downtime are required. Test the plugin functionality post-update in a staging environment if managing mission-critical analytics integrations.

Detection guidance

Monitor WordPress audit logs and REST API request logs for POST, PUT, or PATCH requests to Site Kit endpoints originating from non-administrator user sessions. Look for modifications to plugin settings by Editor-level or dashboard-sharing users, particularly targeting Google service integrations or analytics configuration. Use WordPress security plugins with audit trail functionality to log user actions and API requests. Review user role assignments to identify which accounts hold Editor or sharing permissions; cross-reference with plugin access logs to spot unusual activity. Check the Site Kit plugin settings for unexpected changes in Google API credentials, tracking configuration, or service integrations.

Why prioritize this

Despite the LOW CVSS score, this vulnerability warrants timely but non-urgent patching. The issue affects authorization controls, which are foundational to security posture. Organizations with strict role separation policies should prioritize this update to maintain governance and compliance. However, the limited exploitability (attacker must already hold elevated credentials) and lack of confidentiality or availability impact mean this is not a critical threat. Patch within your standard update cycle, prioritizing sites where many users hold Editor roles or dashboard sharing permissions.

Risk score, explained

The CVSS 3.1 score of 2.7 reflects a vulnerability with integrity impact only (I:L). The high privilege requirement (PR:H) significantly constrains exploitability—the attacker must already be a legitimate, privileged user. No authentication bypass exists, and the impact is limited to configuration modification without data exposure or service disruption. The attack vector is network-accessible (AV:N) and the impact is unchanged from the attacker's perspective (S:U), but the overall severity remains LOW due to the combination of high privilege requirements and limited impact scope.

Frequently asked questions