CVE-2020-8934

CVSS V2 None CVSS V3 None
Description
The Site Kit by Google plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 1.8.0 This is due to the lack of capability checks on the admin_enqueue_scripts action which displays the connection key. This makes it possible for authenticated attackers with any level of access obtaining owner access to a site in the Google Search Console. We recommend upgrading to V1.8.1 or above.
Overview
  • CVE ID
  • CVE-2020-8934
  • Assigner
  • Google
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2023-07-07T11:46:51.869Z
  • Last Modified Date
  • 2023-07-07T11:46:51.869Z
Weakness Enumerations
CWE URL
CWE-252 http://cwe.mitre.org/data/definitions/252.html
References
Reference URL Reference Tags
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/google-site-kit/site-kit-by-google-171-sensitive-information-disclosure
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2020-8934
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8934
History
Created Old Value New Value Data Type Notes
2024-06-24 14:35:08 Added to TrackCVE