Mapster WP Maps, CVE-2026-12954

CVE, Research URL: CVE-2026-12954
Home page URL: Security reports for Mapster WP Maps
Application: Mapster WP Maps
Published on: Sep 18, 2026
Research Description: The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the `my_profile_update()` function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplied via the `acf-photo-gallery-groups` POST parameter before passing both the meta key and its corresponding value directly to `update_user_meta()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary user meta values, though privilege escalation is not possible.
Affected versions: max 1.24.0.
Status: vulnerable