CVE-2026-8907

An unauthenticated attacker can craft a malicious request to the plugin's settings page, exploiting the missing nonce validation in the `process_init()` function [ref_id=1]. This request, when triggered by a site administrator, can alter plugin settings like zoom level, latitude, and longitude. The vulnerability is further compounded as the saved zoom level is later echoed into an HTML attribute and inline JavaScript on the settings page without proper escaping, enabling script injection [ref_id=1].

The `process_init()` function within `class-admin.php` is responsible for handling the saving of plugin settings. This function checks for the presence of a `save-setting` POST parameter but lacks nonce validation. It directly uses `$_POST` values for `focus-lat`, `focus-lng`, `zoom-level`, `sel_routes`, and `sel_places` to update options via `update_option()` [ref_id=1]. Additionally, the `settings_page()` function echoes the `zoom_level` option into inline JavaScript without sanitization [ref_id=1].

The patch is not provided in the bundle. The advisory indicates that the vulnerability is due to missing nonce validation and unsanitized input. Remediation would involve implementing nonce checks before processing POST data and sanitizing all user-supplied values before saving them to the database and echoing them to the page.