CVE-2023-2526

CVE-2023-2526 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Easy Google Maps plugin for WordPress, specifically versions up to and including 1.11.7. This flaw stems from inadequate nonce validation in the plugin's AJAX action handler. An unauthenticated attacker could exploit this by tricking a site administrator into clicking a malicious link, leading to unauthorized execution of AJAX actions. The vulnerability has a CVSS score of 5.4 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and potentially impacting confidentiality and integrity. The EPSS score is very low, suggesting a minimal likelihood of exploitation. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are also negligible.