{
 "id": "WPSEC-2026-1263",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1263/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1263/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1263/index.md",
 "title": "Mapster WP Maps <= 2.0.5 - Missing Authorization to Unauthenticated Map Modification and Stored Cross-Site Scripting via save-mapmaker REST Endpoint",
 "description": "The Mapster WP Maps plugin for WordPress is vulnerable to unauthorized modification of data via the mapster-wp-maps/save-mapmaker REST endpoint in all versions up to, and including, 2.0.5, due to a permission_callback that always returns true. This makes it possible for unauthenticated attackers to overwrite the configuration of any map, create and modify map feature posts, and overwrite the stored Google Maps API key. Because the map loader colour values are later printed without escaping, attackers can also store web scripts that run whenever a user views a page that displays the affected map.",
 "plugin": {
  "slug": "mapster-wp-maps",
  "name": "Mapster WP Maps",
  "full_name": "Mapster WP Maps",
  "wordpress_org": "https://wordpress.org/plugins/mapster-wp-maps/",
  "advisories_url": "https://wpsec.com/vuln/plugin/mapster-wp-maps/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/mapster-wp-maps"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.0.0",
    "from_inclusive": true,
    "to": "2.0.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.0.0 before 2.0.6"
  ]
 },
 "introduced_in": "2.0.0",
 "fixed_in": "2.0.6",
 "remediation": "Update to 2.0.6 or later.",
 "fix_released": "2026-10-18T11:54:10+00:00",
 "published": "2026-10-20T10:08:26+00:00",
 "updated": "2026-10-20T09:12:49.037878+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1263/",
  "https://plugins.svn.wordpress.org/mapster-wp-maps/tags/2.0.6/",
  "https://wordpress.org/plugins/mapster-wp-maps/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/mapster-wp-maps",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-20"
 }
}