CVE-2022-0952: Sitemap WordPress Auth Bypass Vulnerability

CVE-2022-0952 Overview

CVE-2022-0952 is a critical Cross-Site Request Forgery (CSRF) and authorization bypass vulnerability affecting the Sitemap by click5 WordPress plugin before version 1.0.36. The plugin fails to implement proper authorization checks and CSRF protections when updating options through its REST endpoint. Additionally, the plugin does not verify that options being updated actually belong to the plugin itself.

Critical Impact

Unauthenticated attackers can modify arbitrary WordPress blog options, including users_can_register and default_role, enabling them to create new administrator accounts and achieve complete site takeover.

Affected Products

• Sitemap by click5 WordPress plugin versions prior to 1.0.36
• WordPress installations using vulnerable Sitemap plugin versions
• Sites exposing the plugin's REST API endpoint

Discovery Timeline

• 2022-05-02 - CVE-2022-0952 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-0952

Vulnerability Analysis

This vulnerability combines two critical security weaknesses that together enable complete WordPress site compromise. The Sitemap by click5 plugin exposes a REST API endpoint for updating plugin options, but this endpoint lacks two essential security controls: authorization verification and CSRF token validation.

The most significant aspect of this vulnerability is the absence of option scope validation. The plugin does not restrict which WordPress options can be modified through its REST endpoint, meaning attackers can target any option in the WordPress database—not just those related to sitemap functionality.

The attack requires minimal user interaction, making it highly exploitable in real-world scenarios. An attacker can craft a malicious request that, when triggered by any authenticated WordPress user visiting a malicious page, will modify critical site settings without the user's knowledge or consent.

Root Cause

The root cause is a combination of missing authorization checks (broken access control) and absent CSRF protection in the plugin's REST endpoint handler. The plugin registers a REST route that accepts option update requests but fails to:

1. Verify the requesting user has appropriate administrative privileges
2. Validate a CSRF nonce token with each request
3. Confirm the target option belongs to the plugin's defined option set

This triple failure of security controls allows any request—authenticated or not—to modify WordPress options through the vulnerable endpoint.

Attack Vector

The attack is network-based and can be executed remotely. An attacker would craft a malicious HTTP request to the vulnerable REST endpoint, targeting critical WordPress options. The most impactful attack scenario involves:

1. Setting users_can_register to enabled, allowing public user registration
2. Setting default_role to administrator, granting admin privileges to new registrations
3. Registering a new account through the standard WordPress registration process
4. Logging in with full administrative access to the compromised site

This attack chain can be delivered through various vectors including malicious advertisements, compromised third-party scripts, or targeted phishing campaigns. Since the vulnerability affects a REST endpoint, it can be exploited through standard HTTP requests without requiring complex payload delivery mechanisms.

The vulnerability allows modification of arbitrary WordPress wp_options table entries through the unprotected REST API endpoint. Attackers leverage this by targeting security-critical options that control user registration and default role assignment. For detailed technical analysis and proof-of-concept information, refer to the WPScan Vulnerability Report.

Detection Methods for CVE-2022-0952

Indicators of Compromise

• Unexpected changes to users_can_register WordPress option being enabled
• default_role option modified to administrator without authorization
• New administrator accounts appearing in the WordPress user database
• Unusual REST API requests to the Sitemap plugin endpoints in access logs
• Modified site settings or plugin configurations without administrator action

Detection Strategies

• Monitor WordPress wp_options table for unauthorized modifications to users_can_register and default_role settings
• Review web server access logs for suspicious POST requests to /wp-json/ endpoints related to the Sitemap plugin
• Implement file integrity monitoring on WordPress core configuration files
• Deploy web application firewall (WAF) rules to detect and block CSRF attacks targeting REST endpoints

Monitoring Recommendations

• Enable WordPress audit logging to track all option changes with user attribution
• Configure alerts for new administrator account creation events
• Monitor REST API endpoint access patterns for anomalous request volumes
• Review plugin activity logs regularly for unauthorized configuration changes

How to Mitigate CVE-2022-0952

Immediate Actions Required

• Update the Sitemap by click5 plugin to version 1.0.36 or later immediately
• Audit all WordPress administrator accounts and remove any unauthorized users
• Review and reset critical WordPress options including users_can_register and default_role
• Check access logs for evidence of exploitation attempts prior to patching
• Consider temporarily disabling the plugin if immediate update is not possible

Patch Information

The vulnerability has been addressed in Sitemap by click5 plugin version 1.0.36 and later. Site administrators should update through the WordPress plugin dashboard or by manually downloading the latest version from the WordPress plugin repository. After updating, verify the plugin version in the WordPress admin panel under Plugins > Installed Plugins.

For additional technical details and vulnerability tracking, consult the WPScan Vulnerability Report.

Workarounds

• Disable the Sitemap by click5 plugin entirely until the patch can be applied
• Implement a web application firewall (WAF) rule to block unauthorized requests to plugin REST endpoints
• Restrict access to WordPress REST API endpoints at the server level using .htaccess or nginx configuration
• Disable user registration at the server/network level as an additional safeguard

# WordPress .htaccess configuration to restrict REST API access
# Add to .htaccess file in WordPress root directory

# Block unauthenticated access to REST API endpoints
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/
RewriteCond %{HTTP_COOKIE} !wordpress_logged_in
RewriteRule ^(.*)$ - [R=403,L]
</IfModule>