Medium severity · published Jul 7, 2023
CVE-2020-8934
Site Kit by Google plugin for WordPress
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
The Site Kit by Google plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 1.8.0 This is due to the lack of capability checks on the admin_enqueue_scripts action which displays the connection key. This makes it possible for authenticated attackers with any level of access obtaining owner access to a site in the Google Search Console. We recommend upgrading to V1.8.1 or above.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SK
Site Kit By Google · Google
through 1.8.0 · source: vendor
SK
Site Kit · Google
before 1.8.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-8934
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-8934
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/google-site-kit/site-kit-by-google-171-sensitive-information-disclosure
More from Site Kit By Google
4.3
CVE-2026-62139
WordPress Site Kit by Google plugin <= 1.186.0 - Cross Site Request Forgery (CSRF) vulnerability