A CSRF vulnerability in the WordPress StoryMap plugin (versions ≤ 2.1) allows an attacker to trigger requests that lead to arbitrary SQL queries. Because the plugin lacks proper input validation or escaping, an attacker can read, modify, or delete data stored in the WordPress database. The weakness is consistent with CWE‑352, the absence of CSRF protection.

The vulnerability affects sites running the StoryMap plugin by josepsitjar on WordPress. All versions of the plugin through and including 2.1 are vulnerable, so any WordPress installation that has not upgraded beyond 2.1 is at risk.

The CVSS score of 8.2 indicates high severity, while an EPSS of < 1% suggests a relatively low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Attackers typically need to induce a logged‑in user to visit a malicious page, but once the CSRF request is executed the attacker could tamper with or read database contents.