2.7
Low
CVE-2026-10753 The Site Kit by Google WordPress plugin before 1.176.0 does not properly restrict a REST API write endpoint to…
Description
The Site Kit by Google WordPress plugin before 1.176.0 does not properly restrict a REST API write endpoint to administrators, allowing lower-privileged users who have been granted dashboard sharing access (such as Editors) to modify a site-wide Site Kit by Google WordPress plugin before 1.176.0 setting that should only be modifiable by administrators.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Site Kit by Google 1.176 | earliest → < 1.176.0 | 1.176.0 |