The SVG Map plugin for WordPress suffers from a CSRF vulnerability due to inadequate nonce validation on multiple AJAX endpoints. This flaw enables attackers without authentication to perform sensitive actions including updating plugin settings, deleting map data, and injecting scripts by exploiting the trust of an authenticated administrator. The vulnerability affects all versions up to 1.0.0. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and partial impact on confidentiality and integrity but no impact on availability. No patch or remediation information is currently available from the vendor or other sources.

An attacker can exploit this vulnerability to perform unauthorized changes to the plugin's configuration, delete map-related data, or inject malicious web scripts by tricking an administrator into executing a crafted request. This can lead to partial loss of confidentiality and integrity of the affected WordPress site. There is no indication of availability impact or known active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution by limiting administrator exposure to untrusted links and consider disabling or removing the SVG Map plugin if not essential. Monitoring for plugin updates from Smjrifle is recommended to apply any forthcoming patches promptly.