Unauthenticated Post Content Exposure in Mapster WP Maps

Executive Summary

This vulnerability affects the Mapster WP Maps WordPress plugin before version 1.24.0. It exposes a public REST endpoint that lacks authorization checks, allowing unauthenticated users to access the title and full content of any post, including unpublished ones like drafts, pending posts, private posts, and trashed posts.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your WordPress site uses the Mapster WP Maps plugin version before 1.24.0. Use the WordPress admin panel to view the plugin version or run a command like 'wp plugin list' if using WP-CLI. If the version is outdated, update it immediately.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated users could read sensitive or confidential information from posts that were intended to remain private or unpublished. This includes draft content, internal communications, or other restricted material.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face compliance violations and potential legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Mapster WP Maps WordPress plugin to version 1.24.0 or later to address the authorization flaw.

Useful 0 Not Useful 0