CVE-2026-12954
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to and including 1.23.0 via the my_profile_update() function. The lack of nonce verification, capability checks, and meta key validation allows an authenticated attacker with Subscriber-level access to modify arbitrary user metadata.
Risk Assessment
An attacker with a basic account can modify other users' metadata, potentially leading to data manipulation and bypassing security mechanisms, although privilege escalation is not possible.
Recommendation
Update the Mapster WP Maps plugin to a version later than 1.23.0 or disable it until a fix is deployed.
Other vulnerabilities in Mapster WP Maps
See all- CVE-2026-39720High
Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps versions up to 2.0.4.
- CVE-2025-9044Medium
The Mapster WP Maps plugin for WordPress (versions up to and including 1.20.0) is vulnerable to Stored Cross-Site Scripting via multiple fields due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level permissions and above can inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page.
Original NVD description (English source)
The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the `my_profile_update()` function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplied via the `acf-photo-gallery-groups` POST parameter before passing both the meta key and its corresponding value directly to `update_user_meta()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary user meta values, though privilege escalation is not possible.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS