CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Site Kit by Google plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 1.8.0 This is due to the lack of capability checks on the admin_enqueue_scripts action which displays the connection key. This makes it possible for authenticated attackers with any level of access obtaining owner access to a site in the Google Search Console. We recommend upgrading to V1.8.1 or above.
Explanation of Vulnerability in Simple Terms
Site Kit By Google versions 1.8.0 and earlier contain an error-handling flaw that allows authenticated users to read sensitive information from the plugin. An attacker with a low-privilege account can access data they should not be able to view. The vulnerability requires valid site credentials but no additional user interaction.
What an attacker can do
Read sensitive information from the plugin that should be restricted from their account level.
Potential impact on your site
Users with low-privilege accounts can access data beyond their permission level, risking exposure of site configuration or other users' information.
Conditions required to exploit
Attacker must have a low-privilege authenticated account on the site.
Key dates
External resources
