CVE-2023-1024

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The WP Meta SEO plugin for WordPress is vulnerable to unauthorized sitemap generation due to a missing capability check on the regenerateSitemaps function in versions up to, and including, 4.5.3. This makes it possible for authenticated attackers with subscriber-level access to generate sitemaps. This vulnerability occurred as a result of the plugin relying on nonce checks as a means of access control, and that nonce being accessible to all authenticated users regardless of role.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
joomunited	WP Meta SEO	<= 4.5.3

References

Timeline

Published: Feb 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-10254.8The Simple File List WordPress plugin before 6.0.10 does not sanitise and escape some of its settings, which could allow high privilege user CVE-2023-10264.3The WP Meta SEO plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the listPostsCategory CVE-2023-10274.3The WP Meta SEO plugin for WordPress is vulnerable to unauthorized sitemap generation due to a missing capability check on the checkAllCateg CVE-2023-10284.3The WP Meta SEO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.3. This is due to mis CVE-2023-10294.3The WP Meta SEO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.3. This is due to mis CVE-2023-10306.1A vulnerability has been found in SourceCodester/code-projects Online Boat Reservation System 1.0 and classified as problematic. Affected by CVE-2023-10318.8MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `settings` endpo CVE-2023-10325.5The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in function __sys_socket_file() in file net/socket.c. This issu CVE-2023-10338.8Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.11.CVE-2023-10348.8Path Traversal: '\..\filename' in GitHub repository salesagility/suitecrm prior to 7.12.9.CVE-2023-10358.8A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been classified as critical. Affected is an unknow CVE-2023-10366.1A vulnerability was found in SourceCodester Dental Clinic Appointment Reservation System 1.0. It has been declared as problematic. This vuln