CVE-2026-12954: Mapster WP Maps <= 1.23.0 - Authenticated (Subscriber+) Arbitrary User Meta Write via 'acf-photo-gallery-groups' Parameter
The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate() function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplied via the acf-photo-gallery-groups POST parameter before passing both the meta key and its corresponding value directly to updateusermeta(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary user meta values, though privilege escalation is not possible.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated WordPress user with Subscriber-level access or higher can exploit it. The attacker does not need administrator privileges or user interaction.
Are sites using the affected plugin version exposed by default?
The vulnerable profile-update function lacks nonce verification, capability checks, and validation of the supplied meta key. An affected installation can therefore be exposed to any account that can authenticate at Subscriber level or above.
What can an attacker change, and can this directly grant administrative privileges?
An attacker can supply an arbitrary user-meta key and corresponding value through the acf-photo-gallery-groups POST parameter, causing user metadata to be updated. The available information states that privilege escalation is not possible through this issue.
How can I determine whether my installation is affected?
Check whether Mapster WP Maps is installed and is version 1.23.0 or earlier. Also review user-meta changes associated with requests containing the acf-photo-gallery-groups parameter, particularly from low-privileged authenticated accounts.