Now officially on WordPress.org

CVE Database / CVE-2026-10753

CVE

CVE-2026-10753 — Site Kit by Google – Analytics, Search Console, AdSense, Speed [google-site-kit] < 1.176.0

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2026-10753 Site Kit by Google – Analytics, Search Console, AdSense, Speed [google-site-kit] < 1.176.0 Incorrect Authorization Unknown < 1.176.0 1.176.0 2026-06-24 —

CVE-2026-10753

A vulnerability exists in the Site Kit by Google plugin for WordPress prior to version 1.176, where an unintended group of users can alter a global configuration through a REST API endpoint intended solely for administrators. Specifically, editors with dashboard sharing access are able to make changes that should be restricted to admins. This flaw allows non-administrators to modify settings they shouldn't have access to.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings