Unauthenticated REST API Allows Arbitrary Post Modification

The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin before 2.0.6's stored settings.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Mapster WP Maps WordPress plugin before version 2.0.6 contains a critical authorization bypass vulnerability in its REST API implementation. By failing to validate user authentication and permissions on a POST-related endpoint, the vulnerability allows unauthenticated attackers to directly manipulate WordPress content—specifically overwriting post titles, creating new published posts, and modifying plugin configuration settings. This affects any WordPress installation running the vulnerable plugin version, regardless of site visibility or access controls. The impact is severe because WordPress post data is foundational to site integrity, and unauthorized modifications can lead to content injection, SEO poisoning, malware distribution, or complete site defacement.

Casky's 283 mapped skills detect this attack pattern by correlating MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access) with behavioral indicators of the underlying CWE-862 (Missing Authorization) flaw. Practitioners using Casky's extended reasoning would identify suspicious REST API requests lacking authentication headers targeting post-write endpoints, followed by unexpected post creation or modification events in WordPress logs. The detection framework would flag anomalies such as unauthenticated API calls succeeding with administrative-level operations, plugin setting changes originating from external sources, or bulk post modifications from unusual IP addresses—patterns distinctly associated with authorization bypass exploitation rather than legitimate plugin functionality.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-118638.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-118638

Casky has 283 skills that investigate the attack patterns behind CVE-2026-118638. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn