CVE-2022-0952
Published: 02 May 2022
Summary
CVE-2022-0952 is a high-severity CSRF (CWE-352) vulnerability in Sitemap Project Sitemap. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 0.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability CVE-2022-0952 affects the Sitemap by click5 WordPress plugin prior to version 1.0.36. It arises from absent authorization and CSRF checks on a REST endpoint that updates options, along with no validation that the option belongs to the plugin. The flaw is tracked under CWE-352 and CWE-862 and carries a CVSS 3.1 score of 8.8.
Unauthenticated attackers can send crafted requests to the endpoint and modify any WordPress blog option. This capability lets them enable user registration, set the default role to administrator, create a new admin account, and fully compromise the site.
The references point to WPScan entries that document the issue and confirm the fix in plugin release 1.0.36.
The EPSS score stands at a current value of 0.8822 with a recorded peak of 0.8978.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-15964
Vulnerability details
The Sitemap by click5 WordPress plugin before 1.0.36 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the plugin. As a result, unauthenticated…
more
attackers could change arbitrary blog options, such as the users_can_register and default_role, allowing them to create a new admin account and take over the blog.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring an access control policy ensures authorization checks are defined and applied for critical functions.
Reviews of access controls detect missing authorization checks on critical functions or resources.
Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.
Requiring attribute association with information prevents authorization from being performed without necessary security or privacy context.
Mandating authorization prior to allowing remote connections addresses missing authorization for remote access.
Mandating authorization before wireless connections are allowed prevents missing authorization for wireless access.
The control requires authorization before allowing mobile device connections, directly mitigating missing authorization for system access.
Requiring approvals for account creation and specifying authorizations ensures authorization is not missing for system access.