CVE-2026-62139 in Site Kit Plugin
Summary
by MITRE • 09/11/2026
Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186.0 versions.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified as an unauthenticated Cross-Site Request Forgery within the Site Kit plugin for WordPress, specifically affecting versions up to and including 1.186.0, represents a significant security flaw that allows attackers to manipulate authenticated users into performing unintended actions on behalf of their current session without any form of authentication or verification from the user's side. This type of attack exploits the inherent trust that web applications have in requests originating from an authenticated user, leveraging the fact that browsers automatically include credentials such as cookies with every request made to a domain where the user is logged in. In this specific context, the Site Kit plugin, which integrates various Google services like Analytics and Search Console into WordPress dashboards, fails to implement adequate anti-CSRF protections for certain endpoints or actions exposed by its codebase. This oversight means that an attacker can craft malicious HTML pages containing hidden forms or JavaScript commands designed to trigger these vulnerable requests when visited by a logged-in administrator of the target site.
From a technical perspective, the core issue lies in the absence of unique, secret tokens associated with each user session and validated on every state-changing request. Standard web application security practices dictate that any action modifying server-side data must require a CSRF token generated per-session to ensure that the request originated from an authorized source within the same context. The lack of such validation mechanisms in Site Kit versions prior to 1.186.0 allows for straightforward exploitation where the attacker does not need to bypass any authentication barriers or steal session cookies directly. Instead, they rely on social engineering tactics to lure a privileged user into visiting a malicious page hosted by the attacker. Once visited, if the victim is authenticated with their WordPress account and has Site Kit installed and configured, the browser will automatically send the necessary cookies along with the forged request, causing the server to process it as legitimate because it appears to come from an authorized source.
The operational impact of this vulnerability can be severe depending on the privileges held by the targeted user. If a site administrator is tricked into executing these requests, attackers could potentially alter plugin settings, disconnect Google services integration, inject malicious configurations, or even escalate their access further if other vulnerabilities are chained with this CSRF flaw. This undermines the integrity and confidentiality of the website's administrative functions. The attacker gains the ability to perform actions that should require explicit user consent, effectively hijacking the trust relationship between the browser and the web application. For organizations relying on Site Kit for monitoring performance and search visibility through Google services, such tampering could lead to inaccurate data reporting, loss of integration functionality, or complete disruption of administrative workflows until the issue is detected and remediated manually by IT staff.
Industry standards classify this flaw under CWE-352, which defines Cross-Site Request Forgery as a vulnerability where an attacker causes a user to submit a request that they did not intend to submit. This classification highlights the failure in input validation regarding the origin of state-changing requests. Furthermore, within the MITRE ATT&CK framework, this technique aligns with T1566.002, which refers to Spearphishing Link attacks under the Initial Access tactic. Although CSRF itself is often considered an impact mechanism rather than a direct initial access vector in isolation, it serves as a critical component in attack chains where privilege escalation or persistent backdoor installation occurs after gaining foothold through phishing. The exploitation of this vulnerability requires no special privileges for the attacker initially but relies heavily on the social engineering aspect to get a privileged user to interact with malicious content.
Mitigation strategies primarily involve upgrading the Site Kit plugin to version 1.186.0 or later, where Google has addressed these security gaps by implementing robust CSRF token validation mechanisms across all sensitive endpoints. Administrators should ensure that their WordPress environments are kept up-to-date with the latest patches for all installed plugins and themes to minimize exposure to known vulnerabilities. Additionally, deploying Web Application Firewalls can provide an additional layer of defense by detecting anomalous request patterns associated with CSRF attacks, although this is not a substitute for proper code-level fixes. Security teams should also enforce strict Content Security Policy headers where applicable and educate users on the risks of clicking unknown links while logged into administrative portals to reduce the likelihood of successful social engineering attempts that precede such technical exploits.