Mapster WP Maps CVE-2026-12954

Requires an authenticated account with Subscriber-level access or above on a site running Mapster WP Maps <=1.23.0; practical exploitation depends on the site permitting low-privilege user registration or the attacker otherwise obtaining a Subscriber account. The vulnerable my_profile_update() handler must be reachable and accept the acf-photo-gallery-groups POST parameter, which it processes with no nonce verification, no capability check, and no meta-key allowlist. Limiting factor: impact is confined to writing arbitrary user meta values and, per the vendor, does NOT permit privilege escalation, so it cannot directly yield admin takeover.

The vendor (Wordfence) CVSS of 8.8 with C:H/I:H/A:H is materially overstated relative to the description, which explicitly states 'privilege escalation is not possible.' The actual primitive is an arbitrary user-meta WRITE (attacker-controlled meta key and value passed to update_user_meta with no nonce, capability, or allowlist check) - an integrity issue, not a confidentiality or availability compromise, so C:H/I:H/A:H is not supported by the described behavior. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U) is internally consistent: network-reachable, low-complexity, and requiring only Subscriber-level authentication, which is a low bar on any WordPress site with open registration. However, exploitation is bounded because it does not yield privilege escalation or account takeover per the description, limiting real-world impact to corruption/manipulation of user meta values. There is no EPSS score, no CISA KEV listing, and no public POC provided - signal set is 'no public exploit identified at time of analysis.' Net: a real but moderate-priority authenticated integrity flaw, not the 8.8 'critical-adjacent' the vendor score implies; treat the score as inflated and prioritize based on whether the site allows low-privilege user registration.

An attacker registers or obtains a Subscriber-level account on a WordPress site running Mapster WP Maps <=1.23.0, then sends a crafted POST to the profile-update handler with an attacker-chosen meta key/value in the acf-photo-gallery-groups parameter. Because my_profile_update() performs no nonce, capability, or allowlist checks, the value is written directly via update_user_meta(), letting the attacker set arbitrary user meta - though the description confirms this does not achieve privilege escalation. No public exploit code is identified at time of analysis.