CVE-2026-62139: Site Kit by Google CSRF Vulnerability

CVE-2026-62139 Overview

CVE-2026-62139 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability affecting the Site Kit by Google WordPress plugin in versions up to and including 1.186.0. The flaw falls under [CWE-352] and allows an attacker to trick an authenticated WordPress user into performing unintended state-changing actions within the plugin. Exploitation requires user interaction, typically visiting an attacker-controlled page while authenticated to the target WordPress site. The vulnerability can lead to limited integrity impact on plugin configuration without directly exposing credentials or causing service disruption.

Critical Impact
An attacker can coerce an authenticated administrator into submitting forged requests to the Site Kit plugin, potentially altering plugin state or configuration without consent.

Affected Products

Site Kit by Google WordPress plugin versions <= 1.186.0
WordPress installations with the plugin activated
Site administrators using Google service integrations through Site Kit

Discovery Timeline

2026-09-11 - CVE-2026-62139 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-62139

Vulnerability Analysis

The vulnerability stems from missing or insufficient anti-CSRF protections on request handlers within the Site Kit by Google plugin. WordPress plugins typically enforce CSRF protection through nonces validated with check_admin_referer() or wp_verify_nonce(). When these checks are absent or improperly implemented, an attacker can construct a malicious request that a browser will submit on behalf of an authenticated user.

Because the flaw is unauthenticated from the attacker's perspective but requires an authenticated victim, exploitation relies on social engineering. The attacker hosts a page containing a forged form or image tag that triggers a request to the vulnerable endpoint. The impact is scoped to limited integrity changes, consistent with the vector string metrics indicating no confidentiality or availability impact.

Root Cause

The root cause is a missing CSRF token validation on one or more plugin actions. Without a nonce check bound to the user session, the plugin cannot distinguish between a legitimate action initiated by the user and a forged request delivered by a third-party origin. See the Patchstack CSRF Vulnerability Report for advisory details.

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker lures an authenticated WordPress administrator to a crafted page. The victim's browser automatically attaches session cookies to the forged request, causing the plugin to process it as legitimate. No prior authentication or privileges are required on the attacker's side.

No verified public proof-of-concept code is available. Refer to the linked Patchstack advisory for further technical context.

Detection Methods for CVE-2026-62139

Indicators of Compromise

Unexpected changes to Site Kit plugin configuration or connected Google service accounts
Administrative actions in WordPress logs originating from external Referer headers
POST requests to Site Kit endpoints without a valid WordPress nonce parameter

Detection Strategies

Review WordPress access logs for requests to admin.php, admin-ajax.php, or REST API routes tied to google-site-kit with mismatched or missing referer headers
Correlate administrator session activity with off-site referers preceding plugin state changes
Enable WordPress audit logging plugins to track configuration modifications applied by the Site Kit plugin

Monitoring Recommendations

Alert on Site Kit configuration changes outside of change windows
Monitor for anomalous outbound requests from browsers of WordPress administrators
Track plugin version inventory to identify hosts running <= 1.186.0

How to Mitigate CVE-2026-62139

Immediate Actions Required

Update Site Kit by Google to a version newer than 1.186.0 once released by the vendor
Restrict WordPress administrator accounts and enforce least privilege
Instruct administrators to log out of WordPress before browsing untrusted sites

Patch Information

Consult the Patchstack CSRF Vulnerability Report for the vendor-supplied fixed version and remediation guidance. Apply the update through the WordPress plugin manager or automated update tooling.

Workarounds

Deploy a Web Application Firewall (WAF) rule requiring a valid WordPress nonce on Site Kit endpoints
Enforce SameSite=Lax or SameSite=Strict cookies on the WordPress session to reduce CSRF exposure
Temporarily deactivate the Site Kit plugin on high-value sites until the patched version is installed

bash

# Configuration example: enforce SameSite cookies in WordPress wp-config.php
@ini_set('session.cookie_samesite', 'Strict');
@ini_set('session.cookie_secure', '1');
@ini_set('session.cookie_httponly', '1');