The WP-Ultimate-Map WordPress plugin (<=1.1) suffers from a CSRF vulnerability because the process_init() function, hooked to admin_init, lacks nonce validation. This function updates plugin settings based solely on the presence of a save-setting POST parameter. The absence of proper validation allows attackers to forge requests that change plugin settings, including zoom-level, focus-lat, focus-lng, sel_places, and sel_routes. Furthermore, the zoom-level setting is stored without sanitization and later echoed into HTML attributes and inline JavaScript on the settings page without escaping, enabling potential script injection. Exploitation requires tricking an authenticated site administrator into triggering the malicious request.

An attacker can perform unauthorized changes to plugin settings by exploiting the CSRF vulnerability, potentially injecting arbitrary scripts into the settings page due to unsanitized and unescaped stored values. This can lead to limited confidentiality and integrity impacts, such as executing malicious scripts in the context of the administrator's browser. There is no indication of availability impact. The vulnerability requires user interaction (administrator clicking a crafted link) and does not require privileges or authentication for the attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on untrusted links while logged into WordPress admin. Monitoring for plugin updates from the vendor is recommended to apply any official fixes once released.