CVE-2026-10753 Overview
CVE-2026-10753 is a broken access control vulnerability in the Site Kit by Google WordPress plugin before version 1.176.0. The plugin fails to restrict a REST API write endpoint to administrators. Lower-privileged users granted dashboard sharing access, such as Editors, can modify a site-wide plugin setting that should only be modifiable by administrators.
The issue stems from improper authorization checks on a REST API route. Authentication is required to exploit the flaw, limiting impact to users already trusted with dashboard sharing access [CWE-285].
Critical Impact
Authenticated users with dashboard sharing privileges can alter administrator-only Site Kit configuration through the exposed REST API endpoint.
Affected Products
- Site Kit by Google WordPress plugin versions prior to 1.176.0
Discovery Timeline
- 2026-06-24 - CVE-2026-10753 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-10753
Vulnerability Analysis
The Site Kit by Google plugin exposes a REST API endpoint that performs a write operation on a site-wide setting. The endpoint relies on a permission callback that does not enforce administrator-only access. Instead, it accepts any authenticated user who has been granted dashboard sharing access through the plugin's collaboration feature.
Editors and other contributors who legitimately need read access to dashboards inherit write capability on the setting. This violates the principle of least privilege. The flaw is a server-side authorization gap, not a client-side UI restriction issue.
The vulnerability impacts integrity at a limited level. Confidentiality and availability are not directly affected. Exploitation does not require user interaction, and the attacker must already hold dashboard sharing access on the target site.
Root Cause
The root cause is missing role validation in the REST API permission callback. The plugin checks whether the requester has dashboard sharing access, but it does not verify the manage_options capability typically required for administrator-only settings. The result is a misaligned authorization boundary between read-only sharing privileges and write privileges on global configuration.
Attack Vector
An attacker with Editor-level credentials and dashboard sharing access sends a crafted HTTP request to the vulnerable REST API endpoint. The request modifies a site-wide Site Kit setting that should be reserved for administrators. The attack vector is the network, and no additional privilege escalation step is required beyond holding the shared dashboard role.
No public exploit code is currently available. See the WPScan Vulnerability Report for technical details.
Detection Methods for CVE-2026-10753
Indicators of Compromise
- Unexpected modifications to site-wide Site Kit by Google plugin settings performed by non-administrator accounts.
- REST API requests to Site Kit endpoints originating from Editor or contributor sessions.
- Audit log entries showing configuration changes without a corresponding administrator action.
Detection Strategies
- Review WordPress access logs for POST or PUT requests to Site Kit REST API routes issued by non-administrator users.
- Correlate plugin setting changes with the acting user role recorded in WordPress audit logs.
- Deploy a WordPress security plugin or web application firewall capable of logging REST API authorization decisions.
Monitoring Recommendations
- Enable detailed REST API request logging on the WordPress host and forward logs to a centralized analytics platform.
- Alert on Site Kit configuration changes performed by accounts lacking the administrator role.
- Periodically review the list of users granted dashboard sharing access and validate they remain trusted.
How to Mitigate CVE-2026-10753
Immediate Actions Required
- Update the Site Kit by Google WordPress plugin to version 1.176.0 or later on all affected sites.
- Audit dashboard sharing access and remove users who no longer require it.
- Review recent Site Kit setting changes to confirm none were made by non-administrator accounts.
Patch Information
The vendor addressed the vulnerability in Site Kit by Google version 1.176.0. The fix tightens the REST API permission callback to require administrator privileges for the affected write endpoint. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Temporarily revoke dashboard sharing access for all non-administrator users until the patch is applied.
- Restrict access to the WordPress REST API at the web server or WAF layer for unauthenticated and low-privilege sessions.
- Limit Editor accounts on production sites and promote affected users only after the plugin is updated.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
