CVE-2023-3411 in Image Map Pro Plugin
Summary
by MITRE • 06/27/2023
The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to missing nonce validation on the ajax_store_save() function. This makes it possible for unauthenticated attackers to modify plugin settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/10/2026
The Image Map Pro plugin for WordPress represents a popular tool that enables users to create interactive images with clickable areas, but version 1.0.0 contains a critical cross-site request forgery vulnerability that exposes WordPress sites to significant security risks. This vulnerability stems from inadequate input validation within the ajax_store_save() function, which fails to implement proper nonce verification mechanisms. The absence of nonce validation creates a fundamental security flaw that allows attackers to execute unauthorized actions against the vulnerable WordPress installation without requiring authentication credentials.
The technical implementation of this vulnerability involves the manipulation of the ajax_store_save() function which handles the saving of image map configurations through asynchronous requests. When an attacker crafts a malicious request that bypasses the expected nonce validation, they can manipulate plugin settings and potentially inject malicious scripts into the affected WordPress site. This flaw specifically affects the plugin's ability to verify the authenticity of requests originating from legitimate administrators, creating a pathway for unauthorized modifications to the plugin's configuration parameters.
The operational impact of this vulnerability extends beyond simple configuration changes, as it provides attackers with the capability to inject malicious web scripts that could compromise the entire WordPress installation. An attacker can exploit this vulnerability by tricking a site administrator into clicking on a malicious link that triggers the forged request, effectively leveraging the administrator's privileged session to execute unauthorized modifications. This type of attack aligns with the common attack pattern described in the attack technique T1566.002 related to credential access through social engineering and phishing attacks that manipulate users into performing unintended actions.
The vulnerability manifests as a direct consequence of the plugin's failure to implement proper request verification mechanisms, which is classified as a weakness under CWE-352, Cross-Site Request Forgery. This weakness represents a fundamental flaw in the plugin's security architecture, where the absence of proper authentication checks allows attackers to perform actions on behalf of authenticated users. The lack of nonce validation in the ajax_store_save() function creates an exploitable condition that could enable attackers to modify plugin configurations, potentially leading to more severe consequences including persistent malicious code injection and data manipulation.
Organizations using this vulnerable plugin should immediately implement mitigation strategies that include updating to the latest plugin version, which should contain proper nonce validation, and implementing additional security measures such as restricting access to administrative functions through firewall rules and monitoring for suspicious requests. The vulnerability also highlights the importance of proper input validation and authentication checks in web applications, as outlined in the OWASP Top Ten security principles and the MITRE ATT&CK framework's approach to identifying and mitigating common web application vulnerabilities. Administrators should also consider implementing additional security layers including web application firewalls and regular security audits to detect and prevent similar vulnerabilities in other plugins and themes.