CVE-2026-118638 Mapster WP Maps CVE debrief

Who should care

WordPress administrators and defenders responsible for managing and securing WordPress installations using the Mapster WP Maps plugin should assess exposure and prioritize remediation.

Why it matters

CVE-2026-118638 is a high-severity vulnerability in the Mapster WP Maps WordPress plugin that allows unauthenticated attackers to modify posts and plugin settings. Defenders should prioritize verification and remediation to prevent potential misinformation, disruption, or further exploitation.

• Unauthenticated attackers can modify post titles and create new published posts, potentially leading to misinformation or malicious content.
• Attackers can overwrite plugin settings, which could disrupt plugin functionality or be used as a vector for further exploitation.
• Defenders need to verify the version of the Mapster WP Maps plugin and update to version 2.0.6 or later to prevent exploitation.
• Remediation priority is high due to the HIGH CVSS severity score of 7.5.

Technical summary

The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data. This allows unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin before 2.0.6's stored settings. The vulnerability has a high CVSS score of 7.5 and is considered HIGH severity. Defenders should prioritize verifying and remediating this vulnerability in their WordPress installations, especially those using the Mapster WP Maps plugin.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their WordPress installations, especially those using the Mapster WP Maps plugin.

Recommended defensive actions

• Verify the version of the Mapster WP Maps plugin in use and update to version 2.0.6 or later.
• Implement additional authentication and authorization checks for REST API routes.
• Monitor for suspicious activity related to post modifications and plugin settings changes.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7.5 and HIGH severity. The Mapster WP Maps WordPress plugin before 2.0.6 is affected. Evidence is limited to public sources and may not be comprehensive. Defenders should verify the version of the Mapster WP Maps plugin in use and update to version 2.0.6 or later. Additional verification and remediation steps are recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.