CVE-2025-31822: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was identified in the WordPress plugin WP Simple HTML Sitemap (versions through 3.2). The vulnerability, assigned CVE-2025-31822, allows exploiting incorrectly configured access control security levels. The issue was discovered by researcher Kévin Mosbahi (Mika) and was publicly disclosed on April 1, 2025 (Patchstack).

The vulnerability is classified as a Broken Access Control issue (CWE-862) with a CVSS v3.1 score of 5.3 (Medium). The vulnerability vector is described as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, indicating that it can be exploited over the network, requires low attack complexity, needs no privileges, and requires no user interaction (Patchstack).

The vulnerability is characterized as having a low severity impact. It stems from a missing authorization, authentication, or nonce token check in a function that could potentially allow an unprivileged user to execute certain higher privileged actions (Patchstack).

The vulnerability is classified as unauthenticated, meaning it can be exploited without requiring authentication. However, it has been assessed as unlikely to be exploited due to its low severity impact (Patchstack).

As of April 8, 2025, no official fix has been made available for this vulnerability. The vulnerability has been marked as having low patch priority, with virtual patching deemed unnecessary (Patchstack).