Site Kit by Google <= 1.187.0 - Cross-Site Request Forgery via Sign in with Google Callback
- ID
- WPSEC-2026-0222
- Plugin
- Site Kit by Google – Analytics, Search Console, AdSense, Speed (google-site-kit)
- Affected
- from 1.148.0 before 1.188.0
- Remediation
- Update to 1.188.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
- Weakness
- CWE-352
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-22
- Attack surface
- Site Kit by Google on WPSec AttackSurface
- Fix released
- Published
Description
The Site Kit by Google plugin for WordPress is vulnerable to Cross-Site Request Forgery via the Sign in with Google POST callback in all versions up to, and including, 1.187.0. This is due to the callback accepting any valid Google credential without binding it to a sign-in started by the browser, with no nonce claim check and no Origin validation. This makes it possible for unauthenticated attackers to perform login CSRF, forcing a victim's browser into a session for an account of the attacker's choosing, or to submit captured ID tokens from a cross-site form, provided they can trick a user into performing an action such as clicking a link.
References
- https://wpsec.com/vuln/WPSEC-2026-0222/
- https://plugins.svn.wordpress.org/google-site-kit/tags/1.188.0/
- https://wordpress.org/plugins/google-site-kit/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS