CVE-2026-10753

Site Kit by Google < 1.176.0 - Editor+ Email Reporting Settings Update

The Site Kit by Google WordPress plugin before 1.176.0 does not properly restrict a REST API write endpoint to administrators, allowing lower-privileged users who have been granted dashboard sharing access (such as Editors) to modify a site-wide Site Kit by Google WordPress plugin before 1.176.0 setting that should only be modifiable by administrators.

We have discovered 526,878 live websites that are affected by CVE-2026-10753.

Run a Free Instant Scan



Affected Software

Product  Site Kit
Category Analytics
Vulnerable Domains526,878 live websites (39% of Site Kit install base)
Vulnerable Versions
  • from 0 through 1.176
Vulnerable Versions Count176 versions ( 96% of all versions)


Common Weakness Enumeration

CWE-863 Incorrect Authorization



Details

  • Published - Jun 24, 2026
  • Updated - Jun 24, 2026

Credits

  • Shashank (finder)
  • WPScan (coordinator)

Website Distribution by Country

Number of websites using CVE-2026-10753
United States146,758 websites


Japan33,890 websites
Germany32,900 websites
France31,185 websites
GB23,771 websites
Italy20,524 websites
Brazil20,505 websites
Spain19,368 websites
Cyprus15,428 websites
Netherlands14,625 websites

Website Distribution by TLD

Number of websites using CVE-2026-10753
.com240,742 websites
.org20,461 websites
.com.br19,281 websites
.it15,101 websites
.co.uk14,027 websites
.fr13,727 websites
.net13,530 websites
.nl12,845 websites
.de12,008 websites
.pl9,558 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-10753

Top websites that are affected by CVE-2026-10753. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
************.com United States*,***
***.com United States*,***
**********.de Germany*,***
******.com United States*,***
******.com United States*,***
*********.com United States*,***
******.com United States*,***
**********.net United States*,***
******.org United States*,***
*********.com United States*,***
See full domain list

FAQ

CVE-2026-10753 is Incorrect Authorization in Site Kit
A total of 526,878 websites have been identified as vulnerable to CVE-2026-10753, based on global website indexing conducted by WebTechSurvey.
The Site Kit is affected by the CVE-2026-10753 vulnerability.
Site Kit versions up to 1.176 are vulnerable to CVE-2026-10753.
CVE-2026-10753 is resolved in version 1.176 of Site Kit.