CVE-2026-118638 in Mapster WP Maps Plugin
Summary
by MITRE • 10/31/2026
The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin before 2.0.6's stored settings.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/31/2026
The vulnerability identified in versions of the Mapster WP Maps plugin prior to release 2.0.6 represents a critical failure in access control mechanisms within the application’s REST API implementation. This flaw stems from an insufficient authorization check on specific endpoints responsible for writing post data and managing plugin settings. In secure web applications, any operation that modifies state or creates new resources must verify that the requesting user possesses the necessary privileges to perform such actions. The absence of this verification allows unauthenticated actors to interact with these API routes as if they were legitimate administrators, effectively bypassing WordPress’s standard permission hierarchy which typically restricts write operations to authenticated users with specific roles like editor or administrator.
From a technical perspective, the core issue lies in the registration and handling of REST API endpoints where the capability parameter was either omitted or incorrectly configured during development. This oversight means that when an HTTP request is sent to these routes, the server processes it without validating the identity or permissions of the caller. Consequently, attackers can craft malicious requests containing JSON payloads designed to manipulate post titles, inject new published posts into the database, and alter the configuration settings stored by the plugin. The lack of nonce validation further exacerbates this risk, as Cross-Site Request Forgery protections are also bypassed when authorization checks are missing entirely.
The operational impact of this vulnerability is severe due to its potential for widespread exploitation across vulnerable WordPress installations. Attackers can achieve arbitrary code execution indirectly by creating posts that contain malicious scripts or links designed to compromise visitors through cross-site scripting attacks. Furthermore, the ability to overwrite stored settings allows adversaries to disable security features, redirect map data to malicious servers, or deface websites by altering displayed content. This level of control undermines the integrity and availability of the affected systems, potentially leading to significant reputational damage for site owners and exposure of sensitive user data if such posts are viewed by legitimate users.
This vulnerability aligns with CWE-284 Improper Access Control, as it involves a failure to restrict access to resources based on user privileges. Additionally, from an offensive security framework perspective, the exploitation technique corresponds to ATT&CK T1059 Command and Scripting Interpreter if used for XSS payloads or T1136 Create Account if attackers leverage post creation capabilities to establish persistent backdoors within the content management system. The ability to modify settings also touches upon CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component, particularly when those settings influence how data is rendered on the frontend without proper sanitization.
Mitigation strategies must prioritize immediate remediation through software updates. Administrators running versions earlier than 2.0.6 should upgrade to the latest patched version where these authorization checks have been properly implemented and validated by developers. Until an update can be applied, temporary mitigations include restricting access to the WordPress REST API via web application firewall rules or server configuration if feasible, although this may impact legitimate functionality. It is also crucial to audit existing posts for any unauthorized content that may have been injected during potential exploitation periods and review plugin settings for tampering. Regular security audits and adherence to secure coding practices that enforce strict role-based access control on all API endpoints are essential preventive measures against similar vulnerabilities in future developments.