A Cross‑Site Request Forgery (CSRF) flaw in the WordPress Interactive Regional Map of Africa plugin enables an attacker to induce a logged‑in user to send a malicious request to the site, potentially altering or deleting map content without the user’s consent. The vulnerability is defined by CWE-352 and can be triggered by an attacker manipulating a user’s browser to perform unintended actions while authenticated with the website.

Any WordPress installation using the Interactive Regional Map of Africa plugin version 1.0 or earlier is affected. The issue applies to the plugin’s interactive‑map‑of‑africa component across all WordPress datasets that support this plugin. No other vendors or products are listed as impacted.

The CVSS score of 4.3 indicates a moderate severity, but the EPSS score of < 1% reflects a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated user on the target site and a malicious link or form that the victim follows, making it a typical CSRF scenario with limited reach beyond users who have active sessions. The overall risk remains moderate, but because the flaw can affect data integrity and potentially expose sensitive map information, it is advisable to address it promptly.