CVE-2024-9235: Mapster WP Maps Privilege Escalation Flaw

CVE-2024-9235 Overview

CVE-2024-9235 is a privilege escalation vulnerability in the Mapster WP Maps plugin for WordPress. The flaw affects all versions up to and including 1.5.0. The mapster_wp_maps_set_option_from_js() function lacks a sufficient capability check, allowing authenticated users with contributor-level access or higher to modify arbitrary WordPress options. Attackers can leverage this to enable user registration and set the default registration role to administrator, granting themselves full administrative control of the site. The vulnerability is classified under CWE-285: Improper Authorization.

Critical Impact
Authenticated contributors can escalate to administrator by modifying arbitrary site options, resulting in full WordPress site takeover.

Affected Products

Mapster WP Maps plugin for WordPress, all versions through 1.5.0
WordPress sites permitting contributor-level or higher user registration
Sites running the plugin without the patched 1.5.1 or later release

Discovery Timeline

2024-10-25 - CVE-2024-9235 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9235

Vulnerability Analysis

The vulnerability resides in the mapster_wp_maps_set_option_from_js() function within the plugin's REST API handler at admin/api/class-mapster-wordpress-maps-api.php. The function is exposed through an authenticated endpoint that accepts a WordPress option name and value from client-side JavaScript. The endpoint validates that the caller is authenticated but does not verify that the caller has the manage_options capability required to change site-wide settings. As a result, any user session with at least contributor privileges can call the endpoint and invoke update_option() against arbitrary option keys.

The impact extends beyond the plugin's own configuration. WordPress stores security-critical settings such as users_can_register and default_role as standard options. An attacker who can write to these keys can convert the site into an open-registration platform that automatically grants administrator rights to new accounts.

Root Cause

The root cause is a broken access control pattern in which the plugin relies on authentication checks alone and omits capability enforcement. The handler should have called current_user_can('manage_options') and should have restricted the accepted option keys to a plugin-owned allowlist. Neither control was present in vulnerable versions.

Attack Vector

Exploitation requires an authenticated session at contributor level or above. The attacker sends a crafted request to the vulnerable REST endpoint with option_name=users_can_register and option_value=1, then a second request setting option_name=default_role and option_value=administrator. The attacker then registers a new account through the standard WordPress registration flow and receives administrator privileges immediately.

The vulnerability is described in prose only because verified proof-of-concept code is not published. See the Wordfence Vulnerability Report and the WordPress Trac Change Log for the exact code changes that introduce the missing capability check.

Detection Methods for CVE-2024-9235

Indicators of Compromise

WordPress option users_can_register unexpectedly set to 1 on sites that do not permit public registration.
WordPress option default_role changed from subscriber to administrator.
New administrator accounts created shortly after contributor-level logins.
HTTP requests to the plugin's REST route targeting the mapster_wp_maps_set_option_from_js handler.

Detection Strategies

Audit the wp_options table for recent modifications to users_can_register, default_role, and other core security options.
Inspect WordPress user metadata for accounts whose role was promoted to administrator without a corresponding admin action in the audit log.
Correlate web access logs for POST requests to the Mapster WP Maps API endpoint originating from non-administrator sessions.

Monitoring Recommendations

Enable a WordPress audit logging plugin to capture option changes and role modifications in real time.
Alert on any change to default_role or users_can_register outside a controlled change window.
Monitor for administrator account creation events and require multi-party review for privileged role assignments.

How to Mitigate CVE-2024-9235

Immediate Actions Required

Update Mapster WP Maps to version 1.5.1 or later, which adds the missing capability check.
Review all WordPress administrator accounts and remove any that were not provisioned by authorized staff.
Reset the users_can_register and default_role options to their intended values if they were altered.
Rotate credentials for existing contributor and author accounts to invalidate potentially stolen sessions.

Patch Information

The vendor addressed the issue in Mapster WP Maps 1.5.1. The fix introduces a capability check inside the REST handler and constrains which options the function is permitted to update. Patch details are available in the WordPress Trac Changeset #3173973 and the plugin listing at the WordPress Plugin Page.

Workarounds

Deactivate and remove the Mapster WP Maps plugin until the patched version can be deployed.
Restrict contributor and author registration on affected sites to reduce the pool of accounts able to trigger the vulnerable endpoint.
Place a web application firewall rule in front of the plugin's REST route to block requests from users who do not hold the manage_options capability.

bash

# Verify plugin version and force update via WP-CLI
wp plugin get mapster-wp-maps --field=version
wp plugin update mapster-wp-maps --version=1.5.1

# Audit critical options after remediation
wp option get users_can_register
wp option get default_role