Mapster WP Maps CVE-2026-118638

The site must run Mapster WP Maps for WordPress at a version below 2.0.6 with the plugin active, exposing its REST API route that writes post data. No special configuration, feature toggle, user interaction, or authentication is required: per the CVSS vector (AV:N/AC:L/PR:N/UI:N) the vulnerable REST route performs no authorization check, so any remote unauthenticated attacker who can reach the site's WordPress REST API can trigger it against a default installation. The main limiting factor is deployment footprint - only sites with this specific plugin installed and not yet updated to 2.0.6 are affected; impact is confined to integrity (post titles, created posts, plugin settings) with no direct confidentiality or availability effect.

Signals here point to a moderate, not emergency, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with high integrity impact and no confidentiality or availability impact - consistent with CWE-862 missing authorization on a REST route. SSVC reinforces partial technical impact and marks the issue Automatable:yes (a predictable unauthenticated REST endpoint can be scripted and sprayed), yet records Exploitation:none, meaning no observed exploitation. EPSS is low at 0.15% (4th percentile), and there is no CISA KEV listing, so there is currently no confirmed active exploitation - exploitation status is 'no public exploit identified at time of analysis'. These signals are internally consistent rather than conflicting: a genuinely easy-to-automate unauthenticated write primitive (which justifies the vuln.today 'this_week' label) against a product whose real-world footprint is small, so broad opportunistic exploitation has not materialized. The 'Authentication Bypass' tag is imprecise - CWE-862 is a missing authorization check, so the attacker needs no credentials to bypass because none are checked, rather than defeating an authentication mechanism. Net: a legitimate access-control defect to patch promptly on affected sites, but not a CVSS-inflated non-issue nor a widespread emergency.

An unauthenticated attacker discovers a WordPress site running Mapster WP Maps before 2.0.6 and sends crafted requests directly to the plugin's unauthorized REST API route. Because no authorization check is performed, the attacker overwrites arbitrary post titles, injects new published posts (enabling defacement, spam, or SEO/phishing content), and overwrites the plugin's stored settings. No public exploit code has been identified at the time of analysis, but the low-complexity, no-interaction network vector makes the attack straightforward to automate.