The Mapster WP Maps plugin for WordPress contains an arbitrary user meta write vulnerability that allows authenticated attackers to modify user data.

This vulnerability occurs in the my_profile_update function, which fails to perform nonce verification, capability checks, or allowlist validation on meta keys submitted via the acf-photo-gallery-groups POST parameter. An attacker with Subscriber-level access or higher can leverage this flaw to update arbitrary user metadata.

The ability to update arbitrary user meta values presents a significant risk to data integrity and user account management. While privilege escalation is not directly possible, an attacker could alter security-sensitive user settings, potentially leading to unauthorized account behavior or the disruption of site operations. Given the CVSS score of 8.8, this vulnerability is classified as High severity and requires prompt attention to prevent exploitation.

Immediate Action: There is currently no confirmed patch available for this vulnerability. Administrators should prioritize disabling or removing the Mapster WP Maps plugin until a security update is released by the vendor.

Proactive Monitoring: Security teams should monitor WordPress audit logs for unexpected changes to user meta fields or unusual activity originating from Subscriber-level accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules to block POST requests containing suspicious content in the acf-photo-gallery-groups parameter.

Public Exploit Available: No (exploit_available: unknown)

Due to the high severity of this vulnerability and the potential for unauthorized data manipulation, IT administrators must treat this as a priority. If the Mapster WP Maps plugin is not essential, uninstall it immediately to eliminate the attack surface. If the plugin is required, monitor vendor communication channels closely for a patch and apply it as soon as it becomes available.