---
id: "CVE-2026-118638"
kind: "vulnerability"
aliases: ["CVE-2026-118638"]
title: "Mapster WP Maps WordPress plugin: unauthenticated REST route overwrites posts and settings"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mapster-wp-maps", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-2.0.6-or-later"]
published_at: "2026-10-31T06:16:34+00:00"
first_seen_at: "2026-10-31T06:33:50+00:00"
updated_at: "2026-10-31T06:34:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118638", "first_seen_at": "2026-10-31T06:33:50+00:00"}]
---

# Mapster WP Maps WordPress plugin: unauthenticated REST route overwrites posts and settings

The Mapster WP Maps WordPress plugin before 2.0.6 exposes a REST API route that writes post data without any authorization check. An unauthenticated attacker can overwrite the title of arbitrary posts, publish new posts, and overwrite the plugin's stored settings.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Mapster WP Maps plugin in the WordPress admin under Plugins; a version below `2.0.6` is exposed.
- Confirm the plugin is active on the site; unknown whether deactivated plugins expose the route.

## Fix

- Mapster WP Maps plugin: update to `2.0.6` or later

## Timeline

- 2026-10-31T06:33:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118638

## From the sources

The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin before 2.0.6's stored settings.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_