Live › vulnerability › CVE-2026-118638
The Mapster WP Maps WordPress plugin before 2.0.6 exposes a REST API route that writes post data without any authorization check. An unauthenticated attacker can overwrite the title of arbitrary posts, publish new posts, and overwrite the plugin's stored settings.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 06:33 UTC. All times on this page are UTC.
Sites running the Mapster WP Maps WordPress plugin before version 2.0.6 are exposed, because its REST API route performs no authorization check on write operations. Sites on 2.0.6 or later, or sites without the plugin, are not affected. The sources do not say whether the flaw needs any non-default configuration.
No product ranges from the sources yet.
2.0.6 is exposed.2.0.6 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin before 2.0.6's stored settings.
This page as .md · .json · in your agent: get_signal("CVE-2026-118638")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.