Cross-Site Request Forgery Vulnerability in ImageMapper Plugin for WordPress

CVE-2023-5975

Summary

The ImageMapper plugin for WordPress contains a vulnerability that allows unauthenticated attackers to exploit missing or incorrect nonce validation in multiple functions. This weakens the plugin's security, enabling attackers to perform unauthorized updates to settings if they manage to trick a site administrator into initiating an action, such as clicking on a malicious link. The vulnerability affects all versions up to and including 1.2.6, making it crucial for users to take action to safeguard their sites.

References