A critical CSRF vulnerability in the StoryMap WordPress plugin enables remote attackers to perform unauthorized SQL injection, posing a significant risk to database integrity.

This vulnerability is a Cross-Site Request Forgery (CWE-352) affecting the wp-storymap component, which allows an unauthenticated attacker to execute arbitrary SQL commands via a crafted request.

The ability to perform SQL injection through a CSRF vector allows unauthorized parties to manipulate or exfiltrate data from the underlying WordPress database. With a CVSS score of 8.2, this flaw presents a high risk of sensitive data compromise and potential loss of administrative control over the affected site.

Immediate Action: As no official patch is currently identified, administrators should immediately deactivate and remove the StoryMap plugin from their WordPress environment until a secure version is released.

Proactive Monitoring: Security teams should review database query logs for suspicious patterns or anomalous access requests originating from administrative endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block suspicious cross-site requests and mitigate SQL injection attempts targeting known plugin parameters.

Public Exploit Available: Unknown

Given the high CVSS severity and the potential for database-level compromise, the risk associated with this plugin is substantial. Organizations utilizing the StoryMap plugin should prioritize its removal from their production infrastructure until the vendor provides a verified security update to resolve the identified CSRF-to-SQLi chain.