Security Alert Summary
The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data. This allows unauthenticated attackers to overwrite post titles, create published posts, and overwrite the plugin’s stored settings on affected sites.
CVE Details
- CVE ID: CVE-2026-118638
- Affected component: Mapster WP Maps WordPress plugin
- Affected versions: Versions before 2.0.6 (versions < 2.0.6)
- Published date: October 31, 2026 at 6:16:34 AM (as provided in the CVE record)
- Last modified date: October 31, 2026 at 6:16:34 AM (as provided in the CVE record)
- CVSS v3.1 base score / severity / vector: Not provided in the CVE record
- Authentication / privileges / user interaction: No authentication required (unauthenticated attacker); no privileges required; no user interaction required
- Primary impact:
- Confidentiality: No direct data disclosure indicated in the record
- Integrity: Modification of post titles, creation of arbitrary published posts, and modification of plugin stored settings
- Availability: No availability impact indicated in the record
- CWE / weakness ID: Not provided in the CVE record
Technical Details
The vulnerability exists because a REST API route in the Mapster WP Maps plugin that writes post data does not perform any authorization checks. Without those checks, unauthenticated requests can invoke the write functionality exposed by the route.
According to the CVE description, this missing authorization allows an attacker to:
- Overwrite the title of arbitrary posts
- Create arbitrary published posts
- Overwrite the plugin’s stored settings
The record does not name specific function names or endpoint paths. The core issue is the absence of an authorization check on a REST API route that has write capability for posts and plugin settings. The practical effect is integrity loss of post data and plugin configuration when the route is reachable and unprotected.
How This Could Impact Your Website
Consider a typical site with a site owner, internal staff (editors or contributors), and an external contractor who manages content. An unauthenticated attacker could overwrite post titles or create published posts that appear on the site. That could be used to publish misleading content or impersonate internal communications to site users and contractors.
Because the vulnerability also allows overwriting plugin settings, attacker-controlled changes could alter how embedded maps or related displays behave, potentially misleading visitors or hiding important location information. While the CVE does not describe data disclosure, creating or modifying visible content increases the risk of targeted phishing or social engineering against staff and external contractors.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts that can create or edit posts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Review REST API endpoints and ensure authorization checks are applied to routes that write data or change settings.
- Monitor site activity and logs for unusual post creation or settings changes, and restore affected content from backups if needed.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
