The ViewMedica 9 plugin for WordPress suffers from a CSRF vulnerability due to improper nonce validation on its administrative page. This flaw enables attackers to craft forged requests that, when executed by an authenticated site administrator, can lead to arbitrary SQL query injection. The vulnerability affects all versions up to and including 1.4.15. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. There is no vendor-provided patch or official fix information available at this time.

Successful exploitation could allow an attacker to inject arbitrary SQL queries via a forged request if an administrator is tricked into performing an action. This could lead to limited integrity and availability impacts on the affected system. Confidentiality is not impacted according to the CVSS vector. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when interacting with links or requests related to the ViewMedica 9 plugin. Implementing additional CSRF protections or disabling the plugin if not in use may reduce risk.