Site Kit by Google Plugin up to 1.8.0/1.8.1 on WordPress Connection Key admin_enqueue_scripts return value

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Site Kit by Google Plugin up to 1.8.0/1.8.1 on WordPress. This impacts the function admin_enqueue_scripts of the component Connection Key Handler. The manipulation leads to return value. This vulnerability is uniquely identified as CVE-2020-8934. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Site Kit by Google Plugin up to 1.8.0/1.8.1 on WordPress (WordPress Plugin). It has been rated as problematic. This issue affects the function admin_enqueue_scripts of the component Connection Key Handler. The manipulation with an unknown input leads to a return value vulnerability. Using CWE to declare the problem leads to CWE-252. The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions. Impacted is confidentiality. The summary by CVE is:

The Site Kit by Google plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 1.8.0 This is due to the lack of capability checks on the admin_enqueue_scripts action which displays the connection key. This makes it possible for authenticated attackers with any level of access obtaining owner access to a site in the Google Search Console. We recommend upgrading to V1.8.1 or above.

The weakness was disclosed 07/07/2023. The advisory is shared at wordfence.com. The identification of this vulnerability is CVE-2020-8934 since 02/12/2020. Technical details are known, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• WordPress Plugin

Name

• Site Kit by Google Plugin

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8.0
• 1.8.1

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion