{"id":"CVE-2026-118638","kind":"vulnerability","aliases":["CVE-2026-118638"],"related":[],"title":"Mapster WP Maps WordPress plugin: unauthenticated REST route overwrites posts and settings","description":"The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin before 2.0.6's stored settings.","summary":"The Mapster WP Maps WordPress plugin before 2.0.6 exposes a REST API route that writes post data without any authorization check. An unauthenticated attacker can overwrite the title of arbitrary posts, publish new posts, and overwrite the plugin's stored settings.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mapster-wp-maps","package","self-hosted","wordpress"],"not_affected_if":["plugin-2.0.6-or-later"],"how_to_check":"- Check the installed version of the Mapster WP Maps plugin in the WordPress admin under Plugins; a version below `2.0.6` is exposed.\n- Confirm the plugin is active on the site; unknown whether deactivated plugins expose the route.","fix":"- Mapster WP Maps plugin: update to `2.0.6` or later","status":"open","published_at":"2026-10-31T06:16:34+00:00","first_seen_at":"2026-10-31T06:33:50+00:00","triaged_at":"2026-10-31T06:34:23+00:00","updated_at":"2026-10-31T06:34:23+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T06:34:23Z","model":"claude-haiku-5-5","output":{"fix":"- Mapster WP Maps plugin: update to `2.0.6` or later","reach":"internet","title":"Mapster WP Maps WordPress plugin: unauthenticated REST route overwrites posts and settings","impact":"high","summary":"The Mapster WP Maps WordPress plugin before 2.0.6 exposes a REST API route that writes post data without any authorization check. An unauthenticated attacker can overwrite the title of arbitrary posts, publish new posts, and overwrite the plugin's stored settings.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","mapster-wp-maps","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attackers publish posts and overwrite site settings without logging in","analyst_note":"","how_to_check":"- Check the installed version of the Mapster WP Maps plugin in the WordPress admin under Plugins; a version below `2.0.6` is exposed.\n- Confirm the plugin is active on the site; unknown whether deactivated plugins expose the route.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-2.0.6-or-later"],"who_is_affected":"Sites running the Mapster WP Maps WordPress plugin before version 2.0.6 are exposed, because its REST API route performs no authorization check on write operations. Sites on 2.0.6 or later, or sites without the plugin, are not affected. The sources do not say whether the flaw needs any non-default configuration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000701,"input_tokens":4141,"output_tokens":573,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118638':15A,18A '-2026':14A,17A '2.0.6':35B,76C,115C 'allow':92C 'api':39B,86C 'arbitrari':57B,100C,103C 'attack':51B,94C 'author':47B,81C 'check':48B,82C 'creat':102C 'cve':13A,16A 'data':44B,91C 'expos':36B 'host':26B 'map':3A,22B,31B,72C,111C 'mapster':1A,20B,29B,70C,109C 'mapster-wp-map':19B 'new':60B 'overwrit':9A,53B,63B,96C,107C 'packag':23B 'perform':79C 'plugin':5A,33B,65B,74C,113C 'post':10A,43B,58B,61B,90C,101C,105C 'publish':59B,104C 'rest':7A,38B,85C 'rout':8A,40B,87C 'self':25B 'self-host':24B 'set':12A,68B,118C 'store':67B,117C 'titl':55B,98C 'unauthent':6A,50B,93C 'without':45B 'wordpress':4A,27B,32B,73C,112C 'wp':2A,21B,30B,71C,110C 'write':42B,89C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Mapster WP Maps WordPress plugin before version 2.0.6 are exposed, because its REST API route performs no authorization check on write operations. Sites on 2.0.6 or later, or sites without the plugin, are not affected. The sources do not say whether the flaw needs any non-default configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T06:16:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118638","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118638","severity":null,"published_at":"2026-10-31T06:16:34+00:00","modified_at":"2026-10-31T06:16:34+00:00","first_seen_at":"2026-10-31T06:33:50+00:00","fetched_at":"2026-10-31T06:33:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}