The Advanced iFrame plugin for WordPress contains an improper input validation vulnerability (CWE-20) in the aip_map_url_callback() function. This flaw allows unauthenticated attackers to update the advancediFrameParameterData option with excessive unvalidated data, potentially leading to unauthorized excessive creation of options. The issue affects all plugin versions up to 2024.5. The CVSS 3.1 base score is 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts integrity but not confidentiality or availability.

The vulnerability allows unauthenticated attackers to modify plugin options with excessive unvalidated data, which may affect the integrity of the plugin's stored parameters. There is no direct impact on confidentiality or availability reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the vulnerable functionality or disabling the plugin if feasible.