Missing Authorization in Google XML Sitemaps Upgrade Handler

The plugin ships upgrade-plugin.php, which bootstraps WordPress directly and is reachable over HTTP with no capability or security-token check. An unauthenticated attacker can request it with action=yes to change plugin options, force an outbound request to the vendor API, and re-activate the plugin's rewrite and IndexNow hooks. The fix requires... Weiterlesen