CVE-2025-64632: 
WordPress vulnerability analysis and mitigation

CVE-2025-64632 is a Missing Authorization (Broken Access Control) vulnerability in the Auctollo Google XML Sitemaps WordPress plugin (google-sitemap-generator). It affects all versions through 4.1.22 and was reported by researcher NumeX on August 22, 2025, with public disclosure by Patchstack on October 31, 2025, and CVE assignment on December 16, 2025. The vulnerability has a CVSS v3.1 base score of 5.3 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning one or more plugin functions fail to perform adequate authorization checks before executing privileged actions. This allows unauthenticated, remote attackers to invoke functionality that should be restricted to higher-privileged users (e.g., administrators), exploiting incorrectly configured access control security levels. No authentication, user interaction, or special conditions are required for exploitation, as reflected in the CVSS vector (AV:N/AC:L/PR:N/UI:N) (Patchstack).

Successful exploitation results in a low integrity impact — an unauthenticated attacker can perform unauthorized actions within the plugin's scope, such as triggering sitemap regeneration or modifying plugin-controlled settings, without affecting confidentiality or availability. The vulnerability does not provide direct access to sensitive data or enable remote code execution, limiting its overall severity. However, Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting large numbers of WordPress sites simultaneously (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-64632. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with unlikely exploitation impact (Patchstack).

The vulnerability is patched in Google XML Sitemaps version 4.1.23. Site administrators should update the plugin to version 4.1.23 or later immediately via the WordPress admin dashboard or by downloading the updated plugin from the WordPress plugin repository. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. No configuration-based workaround is documented; updating is the only recommended remediation (Patchstack).