• Resolved naturali

    (@naturali)


    I am writing to report a critical technical issue encountered on our WordPress site involving the Google Site Kit plugin.

    Issue Description: The site experienced a PHP Fatal Error (TypeError) triggered by the Email_Reporting_Pointer.php file. Specifically, the explode() function received an array instead of the expected string, causing a crash in the admin dashboard.

    Findings: Upon investigation, we identified that this error coincided with a series of automated “SQL Injection” attempts. We received delivery failure notifications for emails sent to suspicious addresses containing malicious payloads (e.g., pg_sleep commands). It appears that these automated bots targeted the “Email Reporting” feature of Site Kit, leading to data corruption in the user meta-data and subsequent code failure.

    Actions Taken:

    1. Mitigation: The “Email Reporting” feature within Google Site Kit has been disabled to bypass the faulty code.
    2. Stability: The site is currently stable, and the critical errors have subsided.
    3. Next Steps: We are monitoring the logs for further suspicious activity and recommend a full reset of the Site Kit settings to ensure no residual corrupted data remains in the database.

    Please let me know if further investigation or security hardening is required.

    The page I need help with: [log in to see the link]

Viewing 15 replies - 1 through 15 (of 15 total)
  • Plugin Support Adam Dunnage

    (@adamdunnage)

    Hello @naturali, thanks for reaching out and for raising this issue with us which appears to be related to the newly released email reports feature. We will look into this further for you. To help us with this, please could you share the following:

    1. Your Site Health information. You can use this form to share privately if preferred.
    2. A recording of this happening on your site if possible. This will require you to enable email reports once more. If you are unable to do that, do you have a screenshot of the error you could share?
    3. A copy of your logs as we may be able to spot something important that may need to be addressed.

    All the information above would be greatly appreciated and would help us in our investigation. Once shared, we will review everything and get back to you as soon as possible with some possible next steps to take.

    If you have any other questions in the meantime, please let us know.

    Plugin Support Adam Dunnage

    (@adamdunnage)

    @naturali Thanks for sharing the information requested. We are investigating this and have opened a new issue for it. Thanks for raising this and as soon as I have an update on this I will pass it on here.

    If you have any other questions in the meantime or have more useful information to pass on then please let me know here. Thanks again for bringing this to our attention.

    Thread Starter naturali

    (@naturali)

    After the update that crashed the site, I rolled back to the previous version and performed a Reset of Site Kit, but the crash persists

    Plugin Support Adam Dunnage

    (@adamdunnage)

    @naturali Thanks for the update. This is because you have corrupted data in your database and would need to reset the value of dismissed_wp_pointers in your database as an immediate fix. We can’t help with this here as that is out of the scope of the support we can offer. If you are comfortable in doing that then great, otherwise the Github issue shared above will address this once it’s rolled out.

    If possible, would you be able to share with us a download of one of the bounced emails? This may help us find out more about this situation. You can share this via Google Drive or in the private form you’ve previously shared your information.

    Thread Starter naturali

    (@naturali)

    DNS Error: DNS type ‘mx’ lookup of example.com6cetbqhror802select802frompgsleep15 responded with code NXDOMAIN Domain name not found: example.com6cetbqhror802select802frompgsleep15 For more information, go to https://support.google.com/mail/?p=BadRcptDomain

    Thread Starter naturali

    (@naturali)

    הכתובת לא נמצאהההודעה שלך לא נמסרה אל testing@example.<wbr>como2cizsqbor955select955fromp<wbr>gsleep15 מפני שהדומיין example.como2cizsqbor955select955frompgsleep15 לא נמצא. כדאי לבדוק אם יש שגיאות כתיב או רווחים מיותרים ולנסות שוב.למידע נוסף

    Plugin Support Adam Dunnage

    (@adamdunnage)

    @naturali Thanks for sharing. As noted above, we are looking into this and will make some improvements as part of the issue opened. If I get any further updates on this I will share them with you here.

    Thread Starter naturali

    (@naturali)

    Hi Site Kit team,

    The bug is causing a fatal crash on my live website
    What’s going on?

    Thanks for looking into this.

    Plugin Support Adam Dunnage

    (@adamdunnage)

    @naturali Thanks for the update. As mentioned above the team are working on the issue I shared with you to make improvements for this on our side. Once that has been deployed I will update you here. I can’t give you a time frame on that but we hope to have it out as soon as we can.

    Thread Starter naturali

    (@naturali)

    What a disappointment. Google, a trillion-dollar company with thousands of engineers, pushed an update that crashes WordPress dashboards worldwide, and the fix has been sitting in a Pull Request for over a week with nobody touching it. One pull request. One merge button. Nobody pressed it.

    This is not a struggling startup. This is Google. The company that built the infrastructure of the modern internet, that processes billions of searches per second, that lectures the world about best practices and web standards, yet somehow cannot review four lines of PHP before they take down real websites that real people depend on for their livelihood.

    The bug is documented. The fix is written. The developer who wrote it even received a code review. And still, nothing moves. Meanwhile, site owners are left diagnosing fatal errors, disabling features, and begging for help on support forums, while the team is apparently busy with more important things. Like what, exactly.

    One job with this update: do not break things. You failed. The least you can do now is fix it fast. Instead, it is being treated like a medium-priority ticket sitting in a backlog.

    Google, you should be embarrassed. Not because bugs happen, they happen to everyone. But because of how little urgency is being shown in fixing the damage that was caused.

    Do better.

    Plugin Support Adam Dunnage

    (@adamdunnage)

    @naturali I appreciate that this is frustrating for you but as mentioned previously, this is going through our processes and will be pushed out when it’s ready to do so.

    We investigated this with all of the information you shared with us and there is nothing that indicates Site Kit is responsible for the SQL Injection attempts. It looks like some malicious code on your site or server has been able to send emails from your site/WP SMTP. This is not related to the Site Kit email reporting feature.

    We have identified an area of improvement on our side which is what the Github issue is for and this will be addressed. However, the issue above is not related to Site Kit so we can’t offer support with that unfortunately as it’s out of scope from the plugin.

    As mentioned above, you can reset the value of dismissed_wp_pointers in your database as an immediate fix otherwise you can wait for the fix.

    Thank you for voicing your concerns but rest assured we are working on the GitHub issue and once released I will let you know here.

    Thread Starter naturali

    (@naturali)

    Howdy!

    WordPress has a built-in feature that detects when a plugin or theme
    causes a fatal error on your site, and notifies you with this
    automated email.

    In this case, WordPress found an error in the plugin. Site Kit by Google.

    Error details===================
    אירעה שגיאה מסוג E_ERROR בשורה 142 בקובץ
    /home/naturali/public_html/wp-content/plugins/google-site-kit/includes/Core/Email_Reporting/Email_Reporting_Pointer.php.
    הודעת שגיאה: Uncaught TypeError: explode(): Argument #2 ($string) must
    be of type string, array given in
    /home/naturali/public_html/wp-content/plugins/google-site-kit/includes/Core/Email_Reporting/Email_Reporting_Pointer.php:142
    Stack trace:
    #0 /home/naturali/public_html/wp-content/plugins/google-site-kit/includes/Core/Email_Reporting/Email_Reporting_Pointer.php(142):
    explode()
    #1 [internal function]:
    Google\Site_Kit\Core\Email_Reporting\Email_Reporting_Pointer->Google\Site_Kit\Core\Email_Reporting\{closure}()
    #2 /home/naturali/public_html/wp-content/plugins/google-site-kit/includes/Core/Admin/Pointer.php(186):
    call_user_func()
    #3 /home/naturali/public_html/wp-content/plugins/google-site-kit/includes/Core/Admin/Pointers.php(56):
    Google\Site_Kit\Core\Admin\Pointer->is_active()
    #4 [internal function]:
    Google\Site_Kit\Core\Admin\Pointers->Google\Site_Kit\Core\Admin\{closure}()
    #5 /home/naturali/public_html/wp-content/plugins/google-site-kit/includes/Core/Admin/Pointers.php(57):
    array_filter()
    #6 /home/naturali/public_html/wp-content/plugins/google-site-kit/includes/Core/Util/Method_Proxy_Trait.php(25):
    Google\Site_Kit\Core\Admin\Pointers->enqueue_pointers()
    #7 /home/naturali/public_html/wp-includes/class-wp-hook.php(341):
    Google\Site_Kit\Core\Admin\Pointers->Google\Site_Kit\Core\Util\{closure}()
    #8 /home/naturali/public_html/wp-includes/class-wp-hook.php(365):
    WP_Hook->apply_filters()
    #9 /home/naturali/public_html/wp-includes/plugin.php(522): WP_Hook->do_action()
    #10 /home/naturali/public_html/wp-admin/admin-header.php(123): do_action()
    #11 /home/naturali/public_html/wp-admin/index.php(137): require_once('...')
    #12 {main}
      thrown
    Thread Starter naturali

    (@naturali)

    is it safe now?
    I saw that there an update, but this problem was not fixed.

    Plugin Support James Osborne

    (@jamesosborne)

    Thanks for the additional information @naturali. Regarding whether it’s safe, I don’t advise on emailing email reports just yet, at least until the GitHub issue is addressed. Email reporting isn’t fully released to all users yet, and we plan on further development with a priority to address this issue. I’ll check to see if this fix is planned be released with Site Kit 1.179.0, set for 2 weeks from now. Once addressed via #12580, this should mitigate such issues for other potentially impacted users also.

    Out of curiosity, given you’re were seeing this error in an email notification, when you had email reporting enabled, did other aspects of the Site Kit dashboard not function as expected?

    Note also that clearing the dismissed_wp_pointers in the wp_usermeta table in your database should fix this. The issue is more to do with your database state. If you’re comfortable doing so, feel free to give that a try if you wish to use enable email reports.

    • This reply was modified 5 months, 2 weeks ago by James Osborne. Reason: Update
    Plugin Support Adam Dunnage

    (@adamdunnage)

    Hi @naturali, Site Kit 1.180.0 is now available which includes the improvements we made for this. Please can you update to the latest version of the plugin and let us know if you encounter any further issues.

Viewing 15 replies - 1 through 15 (of 15 total)

You must be logged in to reply to this topic.