What is the CVSS score of CVE-2026-8907?

CVE-2026-8907 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WP-Ultimate-Map CVE-2026-8907

EUVD-2026-35304 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-09 Wordfence

GHSA-vq77-9gmh-wxx2

CSRF WordPress

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 05:14 vuln.today

CVE Published

Jun 09, 2026 - 03:41 nvd

MEDIUM 6.1

DescriptionCVE.org

The WP-Ultimate-Map plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1. This is due to missing nonce validation on the process_init() function hooked to admin_init, which saves plugin settings (zoom-level, focus-lat, focus-lng, sel_places, sel_routes) via update_option() based solely on the presence of a save-setting POST parameter. Additionally, the saved values - particularly zoom-level - are stored without sanitization and later echoed into an HTML attribute (and inline JavaScript) on the settings page without escaping. This makes it possible for unauthenticated attackers to change plugin settings and inject arbitrary web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

WP-Ultimate-Map plugin for WordPress (versions up to and including 1.1) is vulnerable to a chained CSRF-to-stored-XSS attack that allows unauthenticated network attackers to hijack plugin settings and inject persistent JavaScript into the WordPress admin panel. The missing nonce check on process_init() - hooked to admin_init - means any forged POST with a save-setting parameter will overwrite plugin options without any authentication or state validation. The injected zoom-level value is then stored unsanitized and reflected verbatim into an HTML attribute and inline JavaScript block on the settings page, completing the XSS chain. No public exploit identified at time of analysis.

Technical ContextAI

The vulnerability lives in admin/class-admin.php of the WP-Ultimate-Map plugin (rahulbhangale, CPE: cpe:2.3:a:rahulbhangale:wp-ultimate-map:*:*:*:*:*:*:*:*), specifically at lines L21, L24, and L63 visible in the WordPress plugin SVN repository. The process_init() function is registered as a callback on WordPress's admin_init action hook, which fires on every admin-context request. WordPress's standard CSRF protection relies on nonce tokens (wp_verify_nonce), but this function skips that check entirely, using only the presence of the save-setting POST parameter as a trigger. It then calls update_option() to persist attacker-controlled values - zoom-level, focus-lat, focus-lng, sel_places, and sel_routes - directly into the WordPress options table. The zoom-level value is subsequently output on the settings page without sanitization or escaping, both as an HTML attribute value and within an inline <script> block. The root cause class is CWE-352 (Cross-Site Request Forgery), with the resulting stored XSS as a secondary but high-impact consequence enabled by absent output encoding.

RemediationAI

No vendor-released patched version has been identified at time of analysis - the available references point exclusively to version 1.1 source code with no indication of a subsequent release. Site administrators should remove or deactivate the WP-Ultimate-Map plugin immediately until the vendor publishes a fix that adds nonce validation to process_init() and output-encodes the zoom-level value before rendering. As a compensating control, restrict WordPress admin panel access (wp-admin/) to known IP ranges via server-level rules (nginx allow/deny or Apache Require ip) - this prevents the CSRF payload from reaching the admin_init hook even if an admin is tricked into visiting a malicious page from an untrusted network. Note that IP restriction may break remote administration workflows. Additionally, a Web Application Firewall rule blocking POST requests to wp-admin containing a save-setting parameter from unauthenticated sessions can serve as a secondary control. Monitor for anomalous changes to the zoom-level, focus-lat, focus-lng, sel_places, or sel_routes WordPress options values as an indicator of exploitation. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/334fb374-c84b-4fec-8653-f7ad6af1f631 for updates.