EUVD-2026-51711
GHSA-6gfx-jq3c-phw8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible REST endpoint requires no authentication; exposes full post content with high confidentiality impact; no integrity or availability impact applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished (draft, pending, private, and trashed) posts.
AnalysisAI
Unauthenticated information disclosure in the Mapster WP Maps WordPress plugin (all versions before 1.24.0) exposes the full title and body content of any post - including drafts, private, pending, and trashed posts - through an unprotected public REST API endpoint. Any remote attacker with network access to the WordPress site can enumerate and read content that site owners explicitly withheld from publication, bypassing WordPress's native post-status and capability access controls. A publicly available proof-of-concept exists per WPScan reporting; however, the EPSS score of 0.14% (4th percentile) indicates exploitation has not yet become widespread, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
The affected component is a public REST API endpoint registered by the Mapster WP Maps plugin (CPE: cpe:2.3:a:unknown:mapster_wp_maps:*:*:*:*:*:*:*:*), a WordPress mapping plugin. WordPress exposes REST API routes that can be public or protected depending on whether the registering plugin applies permission callbacks. This plugin registers at least one endpoint without a permission_callback that enforces WordPress's built-in authorization model - specifically, it performs neither a current_user_can() capability check nor a post-status filter to restrict results to publicly published content. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) is the root cause class: the system returns sensitive data to a principal that has no legitimate access rights, purely because authorization logic was omitted from the endpoint registration.
RemediationAI
Upgrade the Mapster WP Maps plugin to version 1.24.0 or later, which introduces proper authorization and post-status checks on the previously unprotected REST endpoint; this is the only fully effective remediation. The patch is confirmed available from the vendor per WPScan advisory at https://wpscan.com/vulnerability/1994e67d-5fdc-445f-a09d-2b25d2b2f445/. As a compensating control where immediate upgrade is not possible, site administrators can temporarily disable the Mapster WP Maps plugin, which removes the vulnerable endpoint from the REST API surface entirely - though this also disables all plugin mapping functionality. Restricting access to the WordPress REST API at the web server or WAF layer is a partial workaround but carries risk of breaking other legitimate REST API consumers. WordPress application-layer firewall rules targeting the specific endpoint path would be more surgical but require knowledge of the exact route registered by the plugin.
More in Mapster Wp Maps
View allThe Mapster WP Maps plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege e
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mapster Technology
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in v
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today