Unauthorized Post Manipulation in Mapster WP Maps WordPress Plugin
CVE-2026-118638

Currently unrated

Key Information:

Vendor

WordPress
Status
Mapster WP Maps
Vendor
CVE Published:
31 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-118638?

The Mapster WP Maps plugin for WordPress, versions prior to 2.0.6, features a significant vulnerability that allows unauthorized users to manipulate post data via a REST API endpoint. This lack of authorization checks enables attackers to overwrite the titles of existing posts, create new published posts, and modify stored settings within the plugin. As a result, this flaw poses a risk to WordPress site integrity and data management, necessitating prompt updates to protect against potential exploitation.

Affected Version(s)

Mapster WP Maps 0 < 2.0.6

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-118638 - Proof of Concept

References

https://wpscan.com/vulnerability/3d3004f1-46f1-479d-bae6-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Usama Arshad
WPScan
.