A missing authorization flaw in the Google XML Sitemaps plugin for WordPress allows an attacker to exploit incorrectly configured access control permissions. This flaw, classified under CWE‑862, means that unauthenticated users can gain access to plugin‑controlled resources that should require proper authentication and authorization. The vulnerability is present in all releases up to and including version 4.1.22, leaving a large swath of sites at risk of improper privilege escalation. The immediate consequence is that a malicious actor could potentially view, alter or delete sitemap data and other configuration settings that influence how search engines crawl the site.

WordPress sites running the Google XML Sitemaps plugin from any version through 4.1.22. The product is managed by Auctollo and is commonly installed on public websites that rely on WordPress for content management.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1 % suggests a very low probability of widespread exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an unauthenticated remote HTTP request to a URL exposed by the plugin. Because the flaw permits bypassing normal authorization checks, an attacker needs no credentials and can simply target vulnerable plugin endpoints.