Executive Summary

The WP-Ultimate-Map plugin for WordPress versions up to and including 1.1 is vulnerable to Cross-Site Request Forgery (CSRF). This happens because the plugin's process_init() function, which saves plugin settings, lacks nonce validation. The function updates settings based only on the presence of a save-setting POST parameter without verifying the request's authenticity.

Additionally, some saved values, especially the zoom-level, are stored without sanitization and later output directly into HTML attributes and inline JavaScript on the settings page without escaping. This combination allows an attacker to trick an administrator into performing an action (like clicking a malicious link), enabling the attacker to change plugin settings and inject arbitrary scripts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an unauthenticated attacker to modify the plugin's settings by tricking a site administrator into executing a forged request. Because the plugin saves settings without proper validation or sanitization, the attacker can inject arbitrary web scripts into the site.

The impact includes potential cross-site scripting (XSS) attacks, which can lead to session hijacking, defacement, or other malicious actions performed in the context of the administrator's browser. This compromises the integrity and security of the WordPress site.

Useful 0 Not Useful 0