Description
Missing Authorization vulnerability in David Gwyer Simple Sitemap – Create a Responsive HTML Sitemap simple-sitemap.This issue affects Simple Sitemap – Create a Responsive HTML Sitemap: from n/a through <= 3.6.0.
Published: 2025-04-30
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability is a Missing Authorization flaw (CWE-862) that allows unauthenticated users to access privileged plugin functionality. The affected WordPress plugin, Simple Sitemap – Create a Responsive HTML Sitemap, does not enforce proper access checks, enabling attackers to view or manipulate sitemap data. The impact can range from exposing site structure to potential manipulation of SEO components, compromising confidentiality and integrity of site metadata.

Affected Systems

The issue affects the WordPress plugin Simple Sitemap – Create a Responsive HTML Sitemap, version 3.6.0 and earlier, released by David Gwyer. It runs on WordPress installations with the free plugin version, as identified by CPE cpe:2.3:a:wpgoplugins:simple_sitemap:*:*:*:*:free:wordpress:*:*.

Risk and Exploitability

The CVSS score of 4.3 indicates low severity, and the EPSS score of <1% suggests a small likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers could exploit the flaw via the plugin's exposed endpoints, assuming the site allows direct access to the plugin URLs. No authentication is required, so the attack vector is likely web-based. The low CVSS reflects that the plugin does not handle highly sensitive data, but organizations should still remediate to prevent potential misuse.

Generated by OpenCVE AI on April 30, 2026 at 20:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the plugin to the latest version (3.6.1 or newer) to address the Missing Authorization flaw
  • Configure WordPress to block unauthenticated requests to the plugin’s admin URLs, ensuring only users with the required capabilities can access them
  • Periodically audit plugin file permissions and review ACLs to confirm that there are no residual access paths for unauthorized users

Generated by OpenCVE AI on April 30, 2026 at 20:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-12768 Missing Authorization vulnerability in David Gwyer Simple Sitemap – Create a Responsive HTML Sitemap.This issue affects Simple Sitemap – Create a Responsive HTML Sitemap: from n/a through 3.5.14.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in David Gwyer Simple Sitemap – Create a Responsive HTML Sitemap.This issue affects Simple Sitemap – Create a Responsive HTML Sitemap: from n/a through 3.5.14. Missing Authorization vulnerability in David Gwyer Simple Sitemap – Create a Responsive HTML Sitemap simple-sitemap.This issue affects Simple Sitemap – Create a Responsive HTML Sitemap: from n/a through <= 3.6.0.
Title WordPress Simple Sitemap – Create a Responsive HTML Sitemap plugin <= 3.5.14 - Broken Access Control vulnerability WordPress Simple Sitemap – Create a Responsive HTML Sitemap plugin <= 3.6.0 - Broken Access Control vulnerability
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Fri, 16 May 2025 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Wpgoplugins
Wpgoplugins simple Sitemap
CPEs cpe:2.3:a:wpgoplugins:simple_sitemap:*:*:*:*:free:wordpress:*:*
Vendors & Products Wpgoplugins
Wpgoplugins simple Sitemap

Wed, 30 Apr 2025 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 30 Apr 2025 17:30:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in David Gwyer Simple Sitemap – Create a Responsive HTML Sitemap.This issue affects Simple Sitemap – Create a Responsive HTML Sitemap: from n/a through 3.5.14.
Title WordPress Simple Sitemap – Create a Responsive HTML Sitemap plugin <= 3.5.14 - Broken Access Control vulnerability
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Wpgoplugins Simple Sitemap
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:12:30.603Z

Reserved: 2025-04-16T06:22:58.198Z

Link: CVE-2025-39413

cve-icon Vulnrichment

Updated: 2025-04-30T17:37:59.541Z

cve-icon NVD

Status : Modified

Published: 2025-04-30T18:15:47.197

Modified: 2026-04-23T15:29:30.370

Link: CVE-2025-39413

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-30T21:00:15Z

Weaknesses