CVE-2022-0952

Medium PUBLISHED

Sitemap by click5 < 1.0.36 - Unauthenticated Arbitrary Options Update

Unknown · Sitemap by click5

Not yet in CISA KEV

Exploited in the wild PoC available

Recommended Action

Treat as actively exploited. Assess exposure, apply compensating controls where patching is delayed, and monitor for abuse.

Confidence
Medium
Exploitation Status
Exploited in the wild
Observed in Sensors
No
Attempts (30d)
Unique Attacker IPs
CISA KEV
Not yet in CISA KEV
CVSS / EPSS
8.8 High

At a Glance

The Sitemap by click5 WordPress plugin before 1.0.36 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the plugin. As a result, unauthenticated attackers could change arbitrary blog options, such as the users_can_register and default_role, allowing them to create a new admin account and take over the blog.

nuclei_scanner
Published
May 02, 2022
First Seen
Jul 21, 2025
CVSS
8.8 High
EPSS
Remote Low complexity Unauthenticated

Recommended Actions

  • Treat as actively exploited. Assess exposure, apply compensating controls where patching is delayed, and monitor for abuse.
  • Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
  • Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.