Site Kit by Google <= 1.187.0 - Unauthenticated Authentication Bypass via Sign in with Google
- ID
- WPSEC-2026-0223
- Plugin
- Site Kit by Google – Analytics, Search Console, AdSense, Speed (google-site-kit)
- Affected
- from 1.148.0 before 1.188.0
- Remediation
- Update to 1.188.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weakness
- CWE-287
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-22
- Attack surface
- Site Kit by Google on WPSec AttackSurface
- Fix released
- Published
Description
The Site Kit by Google plugin for WordPress is vulnerable to Authentication Bypass via the Sign in with Google callback in all versions up to, and including, 1.187.0. This is due to the plugin verifying Google ID tokens with an empty client ID when the module is active but no client ID is configured, which skips the token audience check, and to the callback being processed even when the module is not connected. This makes it possible for unauthenticated attackers to replay a Google-signed ID token issued to an OAuth client they control and log in as the site user with the matching Google account or email, provided the module is in this unconfigured state and the victim has signed in to the attacker's Google application.
References
- https://wpsec.com/vuln/WPSEC-2026-0223/
- https://plugins.svn.wordpress.org/google-site-kit/tags/1.188.0/
- https://wordpress.org/plugins/google-site-kit/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS