CVE-2026-118638
Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST Route
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin before 2.0.6's stored settings.
| Vendor | unknown |
| Product | mapster wp maps |
| Published | Oct 31, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown mapster wp maps
Be the first to know when new unknown vulnerabilities affecting unknown mapster wp maps are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Mapster WP Maps
0 < 2.0.6
References
Credits
Usama Arshad WPScan