Arbitrary User Meta Write Vulnerability in Mapster WP Maps Plugin for WordPress

CVE-2026-12954

What is CVE-2026-12954?

The Mapster WP Maps plugin for WordPress has a vulnerability that allows authenticated users with Subscriber-level access or higher to modify arbitrary user meta values. This weakness arises from the my_profile_update() function, which lacks proper security checks, including nonce verification, capability validation, and allowlist procedures on the meta key provided in the acf-photo-gallery-groups POST parameter. Therefore, attackers can exploit this flaw to manipulate user metadata without any privilege escalation.

References