Is CVE-2022-0952 actively exploited?

Yes. CVE-2022-0952 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2022-0952 be exploited remotely?

The attack vector of CVE-2022-0952 has not been classified yet.

What is the CVSS score of CVE-2022-0952?

CVE-2022-0952 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2022-0952

UNKNOWNCISA KEVIN THE WILD

CVE-2022-0952

Published: April 11, 2026

EPSS:89.19%probability of exploitation in 30 daysPercentile:99.5th

Official Description

The Sitemap by click5 WordPress plugin before 1.0.36 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the plugin. As a result, unauthenticated attackers could change arbitrary blog options, such as the users_can_register and default_role, allowing them to create a new admin account and take over the blog.

NVD Source

Risk Analysis

The Sitemap by click5 WordPress plugin is vulnerable to unauthorized option changes due to missing authorization and CSRF checks. This allows unauthenticated attackers to alter critical blog settings, potentially leading to full site takeover by creating an admin account. Its inclusion in CISA's KEV catalog and active exploitation make this a severe and urgent issue.

This vulnerability is actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog, indicating a high risk of compromise.

Recommended Action

Upgrade the Sitemap by click5 WordPress plugin to version 1.0.36 or newer to address the authorization and CSRF bypass vulnerabilities.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2022-0952 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2022-0952 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.