Site Kit by Google – Analytics, Search Console, AdSense, Speed < 1.176.0 - Missing Authorization to Authenticated (Editor+) Settings Update

2026-06-25 00:00

Shashank

Strategic Overview

Status

Patched in 1.176.0

Affected PluginSite Kit by Google – Analytics, Search Console, AdSense, Speed

Affected Version< 1.176.0

CVSS2.7Low

CVECVE-2026-10753

View all Site Kit by Google – Analytics, Search Console, AdSense, Speed vulnerabilities

Vulnerability Overview

The Site Kit by Google – Analytics, Search Console, AdSense, Speed plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to 1.176.0 (exclusive). This makes it possible for authenticated attackers, with Editor-level access and above, to perform an unauthorized action.

Technical Analysis

REMEDIATION: Update to version 1.176.0, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

External References

https://www.cve.org/CVERecord?id=CVE-2026-10753 https://www.wordfence.com/threat-intel/vulnerabilities/id/ad382ec2-55c8-4d6c-b318-db199f812493

Site Kit by Google – Analytics, Search Console, AdSense, Speed < 1.176.0 - Missing Authorization to Authenticated (Editor+) Settings Update (CVE-2026-10753)