The MapMap WordPress plugin versions up to and including 1.1 are vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation in certain admin functions. This vulnerability allows an attacker to trick a site administrator into performing unintended actions, such as changing plugin settings or injecting malicious scripts via forged requests.