mapster CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH mapster CVE published 2026-09-18

CVE-2026-12954

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0. This vulnerability allows authenticated attackers, with Subscriber-level access and above, to update arbitrary user meta values. The vulnerability exists due to the `my_profile_update()` function performing no nonce verification, no capability check, and no allowlist validation [truncated]