The WP Simple HTML Sitemap plugin version 3.5 and earlier contains a missing authorization vulnerability that results from improperly configured access control mechanisms. This allows unauthenticated remote attackers to perform actions that should require authorization, leading to a potential denial of service or availability impact. The vulnerability is identified as CVE-2025-31822 with a CVSS 3.1 base score of 5.3, indicating a medium severity level. There is no vendor advisory or patch information available at this time.

The vulnerability does not impact confidentiality or integrity but may affect availability due to unauthorized actions possible without proper authorization checks. There are no known exploits in the wild, and no evidence of active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin functionality where possible and monitor for updates from the vendor or security advisories.