CVE-2020-8934CWE-252

Site Kit by Google plugin for WordPress

Medium · published July 7, 2023

CVSS v3.1
4.3
EPSS
0%
Percentile
15.1
In the wild
Unconfirmed
What it is

The Site Kit by Google plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 1.8.0 This is due to the lack of capability checks on the admin_enqueue_scripts action which displays the connection key. This makes it possible for authenticated attackers with any level of access obtaining owner access to a site in the Google Search Console. We recommend upgrading to V1.8.1 or above.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00247 · 15.1th percentile
Weakness
CWE-252 · Unchecked Return Value
Published
2023-07-07T11:46Z
EPSS history
Timeline
  • 07 JUL 11:46Z
    Site Kit by Google plugin for WordPress
    cvelistv5