CVE-2026-118638

Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST Route

The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin before 2.0.6's stored settings.

Affected

Mapster WP Maps

CVSS v3.1 CNA

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.25% chance of exploitation in the next 30 days, 17th percentile

Published

2026-10-31

Updated

2026-11-01

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/3d3004f1-46f1-479d-bae6-754e56d3aa7e/find archive

CVE references

• https://wpscan.com/vulnerability/3d3004f1-46f1-479d-bae6-754e56d3aa7eREFERENCE

References

• CVE Record
• NVD entry