CVE-2026-12954 mapster CVE debrief

Who should care

Defenders responsible for WordPress installations with the Mapster WP Maps plugin version 1.23.0 or earlier should assess the potential impact of this vulnerability on their systems and prioritize verification and potential updates.

Why it matters

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write, allowing authenticated attackers to update arbitrary user meta values. Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess the potential impact on their systems.

• Authenticated attackers with Subscriber-level access and above can update arbitrary user meta values.
• Privilege escalation is not possible, but arbitrary user meta value updates can potentially be used for further exploitation.
• Defenders should verify the presence of this vulnerability in their WordPress installations and assess the potential impact on their systems.
• Remediation priority is moderate, as updating the plugin to a version that addresses this vulnerability is recommended.

Technical summary

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0. This is due to the `my_profile_update()` function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplied via the `acf-photo-gallery-groups` POST parameter before passing both the meta key and its corresponding value directly to `update_user_meta()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary user meta values, though privilege escalation is not possible. The vulnerability highlights the importance of proper input validation and sanitization in WordPress plugins to

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess the potential impact on their systems.

Recommended defensive actions

• Verify the presence of the Mapster WP Maps plugin version 1.23.0 or earlier in your WordPress installation.
• Assess the potential impact of arbitrary user meta value updates on your system.
• Consider updating the plugin to a version that addresses this vulnerability, if available.
• Monitor user meta value updates for potential security issues.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is due to the `my_profile_update()` function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplied via the `acf-photo-gallery-groups` POST parameter.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.