Site Kit by Google: Sensitive information exposure
Site Kit by Google is affected by sensitive information exposure. Exploitation requires an authenticated WordPress account. Successful exploitation can disclose data that should not be available to the caller.
- Component
- Site Kit by Google
- Plugin slug
google-site-kit- Affected
- See vendor advisory
- Safe version
- See mitigation notes
- Published
- Jul 07, 2023
- Weakness
- CWE-252 — Unchecked Return Value
This CVE was published Jul 07, 2023 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
Update Site Kit by Google to a release outside the affected range, or disable and remove it until a fixed version is available.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Site Kit by Google plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 1.8.0 This is due to the lack of capability checks on the admin_enqueue_scripts action which displays the connection key. This makes it possible for authenticated attackers with any level of access obtaining owner access to a site in the Google Search Console. We recommend upgrading to V1.8.1 or above.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N