Site Kit by Google is a dedicated plugin for WordPress allowing the admins to see how the site performs. Besides showing the stats, the plugin also facilitates the quick setup of Google tools. Presently, the plugin boasts more than 400,000 active installations.
Briefly, the bug existed due to a lack of capability check on the admin_enqueue_scripts action. This exposed the proxySetupURL via the HTML source code of admin pages to authorized users with any privileges.
Moreover, there also existed a similar lacking while handling verification requests from incoming users. This allowed any authenticated user to send verification requests regardless of admin privileges.
Consequently, an adversary with authenticated user access to the /wp-admin dashboard could gain owner access to the website’s Search Console.
Regarding the potential threats associated with the exploitation of this bug, the researchers stated,
Owner access allows an attacker to modify sitemaps, remove pages from Google search engine result pages (SERPs), or to facilitate black hat SEO campaigns.The following video demonstrates the PoC of the exploit.
Then, it took a few days for Google to address the flaw. Yet, they eventually released the patch with plugin version 1.8.0.
Hence, all WordPress admins using the Site Kit by Google plugin must ensure updating their sites to the latest plugin version 1.8.0.
Moreover, the researchers also advise resetting the plugin’s connection with the site, as well as to remove any unwanted Search Console users.
Let us know your thoughts in the comments.
