The vulnerability is a missing authorization flaw in the WP Simple HTML Sitemap plugin that allows attackers to access and manipulate sitemap content without proper permissions. This leads to unauthorized viewing, editing, or deletion of sitemap data, potentially exposing website structure and internal pages. The weakness is classified under CWE-862, indicating an improper authorization control.

The flaw affects the WP Simple HTML Sitemap plugin developed by Ashish Ajani. All released versions from the initial release up to and including version 3.5 are susceptible. No specific sub‑versions are listed, so users should assume that any version equal to or older than 3.5 may be impacted.

The vulnerability has a CVSS score of 5.3, indicating moderate severity, and an EPSS score of less than 1%, suggesting a low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. Likely exploitability requires the attacker to access the plugin’s management endpoints over the web, where the access control check is missing. The attack vector is consequently a web-based, publicly reachable service that can be abused by any user without further authentication or privileges.