CVE-2026-118638
HIGH
MEDIUM
Priority: 0.02
BB Relevance:
75/100
Published: 2026-10-31
Modified: 2026-11-02
First seen: 2026-10-31
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
Unchanged
C:
None
I:
High
A:
None
Description
The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin before 2.0.6's stored settings.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| Unknown | Mapster WP Maps | 0 < 2.0.6 |
| Unknown | Mapster WP Maps | 0 < 2.0.6 |