CVE-2026-12954: Mapster WP Maps Auth Bypass Vulnerability

CVE-2026-12954 Overview

The Mapster WP Maps plugin for WordPress contains an arbitrary user meta write vulnerability affecting all versions up to and including 1.23.0. The flaw resides in the my_profile_update() function, which processes the acf-photo-gallery-groups POST parameter without nonce verification, capability checks, or allowlist validation. Authenticated attackers with Subscriber-level access or above can write arbitrary values to any user meta key by passing user-controlled input directly to update_user_meta(). The issue is tracked as an improper input validation weakness [CWE-20]. Privilege escalation is not achievable through this vector, but attackers can corrupt user profile data and manipulate meta-driven plugin or theme behavior.

Critical Impact
Any authenticated WordPress user can overwrite arbitrary user meta values on any account, enabling profile tampering and abuse of meta-dependent site logic.

Affected Products

Mapster WP Maps plugin for WordPress, versions up to and including 1.23.0
WordPress sites with the plugin activated and open subscriber registration
Multisite installations exposing the vulnerable endpoint to authenticated users

Discovery Timeline

2026-09-18 - CVE-2026-12954 published to NVD
2026-09-19 - Last updated in NVD database

Technical Details for CVE-2026-12954

Vulnerability Analysis

The vulnerability exists in the my_profile_update() function inside includes/acf-photo-gallery-field/includes/acf_photo_gallery_save.php. The handler accepts the acf-photo-gallery-groups parameter from an authenticated POST request and forwards its key and value directly to WordPress core's update_user_meta() function. Because the function performs no request-origin validation, no capability enforcement, and no allowlist filtering on the meta key, any logged-in user can specify arbitrary meta keys and values.

Attackers can overwrite fields such as user descriptions, session tokens tracked in meta, plugin-specific flags, or theme personalization data. While the WordPress core wp_capabilities and wp_user_level keys are protected from direct writes and prevent privilege escalation, attackers can still tamper with profile data, disrupt integrations, or influence downstream plugin logic that reads user meta.

Root Cause

The root cause is missing input validation and access control on a meta-write handler. Three distinct safeguards are absent: a nonce check to prove request origin, a capability check to restrict who can invoke the handler, and a meta-key allowlist to constrain which fields the plugin is authorized to modify. The plugin trusts the client-supplied acf-photo-gallery-groups key and treats it as an authoritative pointer into the user meta table.

Attack Vector

An attacker registers or logs in as a Subscriber, then issues a crafted POST request containing the acf-photo-gallery-groups parameter with an arbitrary meta key name and value. The vulnerable handler processes the request over the network without additional authorization, invoking update_user_meta() with the attacker-controlled arguments. Refer to the Wordfence Vulnerability Analysis and the vulnerable source at WordPress Mapster Plugin File - L43 for technical details.

Detection Methods for CVE-2026-12954

Indicators of Compromise

POST requests to WordPress admin or AJAX endpoints containing the acf-photo-gallery-groups parameter from low-privilege sessions.
Unexpected entries in the wp_usermeta table with meta keys that do not match plugin or theme conventions.
Modifications to user profile fields performed by Subscriber-level accounts without administrative context.
Web server access logs showing repeated meta-write requests originating from newly registered accounts.

Detection Strategies

Inspect HTTP request bodies for the acf-photo-gallery-groups parameter and correlate with the requesting user's role.
Audit wp_usermeta rows against a known-good baseline of expected meta keys per plugin.
Alert on any invocation of the plugin's save handler by users without the edit_users capability.
Enable WordPress debug logging around update_user_meta() calls originating from the plugin path.

Monitoring Recommendations

Forward WordPress and web server logs to a centralized analytics platform for role-based query analysis.
Track new Subscriber registrations followed within minutes by writes to profile endpoints.
Monitor plugin file integrity for versions at or below 1.23.0 and flag installations that have not been updated.
Review Wordfence or equivalent WAF telemetry for signatures matching this vulnerability identifier.

How to Mitigate CVE-2026-12954

Immediate Actions Required

Update the Mapster WP Maps plugin to a version above 1.23.0 that contains the fix referenced in the WordPress Mapster Plugin Changeset.
Audit all user meta entries created since the plugin was installed and revert unauthorized changes.
Disable open user registration if it is not required for site operation.
Review Subscriber-level accounts for suspicious creation patterns and remove untrusted users.

Patch Information

The vendor addressed the vulnerability in a Mapster WP Maps release published after 1.23.0. The fix adds request validation to the affected handler. Administrators should apply the update through the WordPress plugin manager and verify the installed version reports higher than 1.23.0. Consult the Wordfence Vulnerability Analysis for confirmed fixed versions.

Workarounds

Deactivate the Mapster WP Maps plugin until the patched version can be deployed.
Deploy a Web Application Firewall rule blocking POST requests that include the acf-photo-gallery-groups parameter from non-administrative users.
Restrict the plugin's endpoint via server-level access controls to authenticated administrators only.
Temporarily set users_can_register to false in WordPress general settings to eliminate the low-privilege attack surface.

bash

# Configuration example: disable open registration and block the vulnerable parameter
wp option update users_can_register 0

# Example nginx rule to block Subscriber-level meta writes
location ~ /wp-admin/ {
    if ($request_method = POST) {
        if ($request_body ~* "acf-photo-gallery-groups") {
            return 403;
        }
    }
}