# Mapster WP Maps <= 2.0.5 - Missing Authorization to Unauthenticated Map Modification and Stored Cross-Site Scripting via save-mapmaker REST Endpoint

- **ID:** WPSEC-2026-1263
- **Plugin:** Mapster WP Maps (`mapster-wp-maps`), https://wordpress.org/plugins/mapster-wp-maps/
- **Affected versions:** from 2.0.0 before 2.0.6
- **Fixed in:** 2.0.6 (Update to 2.0.6 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-20)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/mapster-wp-maps
- **Fix released:** 2026-10-18
- **Published:** 2026-10-20
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1263/

## Description

The Mapster WP Maps plugin for WordPress is vulnerable to unauthorized modification of data via the mapster-wp-maps/save-mapmaker REST endpoint in all versions up to, and including, 2.0.5, due to a permission_callback that always returns true. This makes it possible for unauthenticated attackers to overwrite the configuration of any map, create and modify map feature posts, and overwrite the stored Google Maps API key. Because the map loader colour values are later printed without escaping, attackers can also store web scripts that run whenever a user views a page that displays the affected map.

## References

- https://wpsec.com/vuln/WPSEC-2026-1263/
- https://plugins.svn.wordpress.org/mapster-wp-maps/tags/2.0.6/
- https://wordpress.org/plugins/mapster-wp-maps/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1263/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.