Mapster WP Maps <= 2.0.5 - Missing Authorization to Unauthenticated Map Modification and Stored Cross-Site Scripting via save-mapmaker REST Endpoint

ID

WPSEC-2026-1263

Plugin

Mapster WP Maps (mapster-wp-maps)

Affected

from 2.0.0 before 2.0.6

Remediation

Update to 2.0.6 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness

CWE-862

Usage

Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-20

Attack surface

Mapster WP Maps on WPSec AttackSurface

Fix released

2026-10-18

Published

2026-10-20

Description

The Mapster WP Maps plugin for WordPress is vulnerable to unauthorized modification of data via the mapster-wp-maps/save-mapmaker REST endpoint in all versions up to, and including, 2.0.5, due to a permission_callback that always returns true. This makes it possible for unauthenticated attackers to overwrite the configuration of any map, create and modify map feature posts, and overwrite the stored Google Maps API key. Because the map loader colour values are later printed without escaping, attackers can also store web scripts that run whenever a user views a page that displays the affected map.

References

• https://wpsec.com/vuln/WPSEC-2026-1263/
• https://plugins.svn.wordpress.org/mapster-wp-maps/tags/2.0.6/
• https://wordpress.org/plugins/mapster-wp-maps/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS