The plugin ships upgrade-plugin.php, which bootstraps WordPress directly and is reachable over HTTP with no capability or security-token check. An unauthenticated attacker can request it with action=yes to change plugin options, force an outbound request to the vendor API, and re-activate the plugin’s rewrite and IndexNow hooks. The fix requires the manage_options capability before any of that runs.
This vulnerability affects the following application versions:
- Google XML Sitemaps 4.1.8
- Google XML Sitemaps 4.1.9
- Google XML Sitemaps 4.1.10
- Google XML Sitemaps 4.1.11
- Google XML Sitemaps 4.1.12
- Google XML Sitemaps 4.1.13
- Google XML Sitemaps 4.1.14
- Google XML Sitemaps 4.1.15
- Google XML Sitemaps 4.1.16
- Google XML Sitemaps 4.1.17
- Google XML Sitemaps 4.1.18
- Google XML Sitemaps 4.1.19
- Google XML Sitemaps 4.1.20
- Google XML Sitemaps 4.1.21
- Google XML Sitemaps 4.1.23
- Google XML Sitemaps 4.1.24
- Google XML Sitemaps 4.1.25