The SVG Map Plugin for WordPress has a flaw where several AJAX operations such as 'save_data', 'delete_data', and 'add_popup' lack proper nonce verification. This defect permits unauthenticated attackers to perform actions on behalf of an administrator. By sending a forged request, an attacker may alter plugin settings, delete map data, or insert malicious scripts that are stored and rendered by the site. The weakness is a classic CSRF (CWE‑352) with potential for stored XSS if arbitrary scripts are submitted.

The issue affects the WordPress plugin SVG Map by Smjrifle, versions up to and including 1.0.0. Sites running any version 1.0.0 or older are vulnerable.

The CVSS score of 6.1 indicates moderate severity, while the EPSS score being below 1% reflects a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by tricking an administrator into clicking a crafted link or visiting a malicious site that submits a forged AJAX request. Because the flaw hinges solely on missing nonce validation, no technical barrier exists once an admin authorises the request, making the vector straightforward for social‑engineering attacks.