Unauthenticated Post Title Modification in Mapster WP Maps

Executive Summary

This vulnerability affects the Mapster WP Maps WordPress plugin before version 2.0.6. It allows unauthenticated attackers to modify posts and plugin settings due to missing authorization checks on a REST API route called save-mapmaker. Attackers can overwrite post titles, create new published posts, and change plugin settings without authentication.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your WordPress site is running the Mapster WP Maps plugin version prior to 2.0.6. You can do this by inspecting the plugin version in the WordPress admin panel or via the command line using: wp plugin list --name='mapster-wp-maps'.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers could alter your website's content by changing post titles, creating new posts, or modifying plugin settings. This could lead to misinformation, defacement, or unauthorized content being published on your site. It may also disrupt normal site operations or damage your site's reputation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized changes to sensitive data, potentially violating GDPR or HIPAA if personal or health-related information is altered. Compliance may be compromised due to loss of data integrity and unauthorized access, requiring investigation and potential breach notifications.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Mapster WP Maps plugin to version 2.0.6 or later. If updating is not possible, consider disabling the plugin temporarily until the update is applied. Ensure your WordPress installation and all plugins are regularly updated to prevent similar vulnerabilities.

Useful 0 Not Useful 0