CVE-2025-39413: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2025-39413) is a Missing Authorization vulnerability affecting the WordPress plugin 'Simple Sitemap – Create a Responsive HTML Sitemap' in versions up to and including 3.5.14. The vulnerability was discovered by Ananda Dhakal and was publicly disclosed on April 17, 2025 (WPScan, Patchstack).

The vulnerability is classified as a Broken Access Control issue (OWASP Top 10 A5) with a CVSS score of 4.3 (medium severity). The security flaw stems from a missing capability check on a function, which allows authenticated users with Subscriber-level access and above to perform unauthorized actions. The vulnerability is tracked under CWE-862 (Patchstack).

The vulnerability allows authenticated attackers with Subscriber-level privileges or higher to perform unauthorized actions within the WordPress installation. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).

The vulnerability requires an authenticated user with at least Subscriber-level access to exploit. No public exploits have been reported in the wild (Patchstack).

Currently, there is no official fix available for this vulnerability. The issue affects versions up to and including 3.6.0, and no patched version has been released yet (Patchstack).