---
id: CVE-2026-118638
title: >-
  Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via
  save-mapmaker REST Route
summary: >-
  The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any
  authorization check on a REST API route that writes post data, allowing
  unauthenticated attackers to overwrite the title of arbitrary posts, create
  arbitrary publishe…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'
cvssSource: adp
cwe:
  - CWE-862
product: Mapster WP Maps
affected:
  - mapster_wp_maps < 2.0.6
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-01T17:27:12.972455Z'
published: '2026-10-31'
updated: '2026-11-01'
sourceUpdated: '2026-11-01T17:34:16.868Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118638'
references:
  - url: 'https://wpscan.com/vulnerability/3d3004f1-46f1-479d-bae6-754e56d3aa7e/'
tags:
  - cve.org
epss: 0.00253
epssPercentile: 0.16962
ingestedAt: '2026-11-05T18:28:50.796Z'
---

## Overview

The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin before 2.0.6's stored settings.

## Affected

- `mapster_wp_maps < 2.0.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.