WordPress Mapster Plugin Arbitrary User Meta Write Flaw

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the `my_profile_update()` function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplied via the `acf-photo-gallery-groups` POST parameter before passing both the meta key and its corresponding value directly to `update_user_meta()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary user meta values, though privilege escalation is not possible.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Mapster WP Maps plugin for WordPress contains a critical arbitrary user meta write vulnerability affecting all versions up to 1.23.0. The `my_profile_update()` function fails to implement essential security controls—nonce verification, capability checks, and meta key allowlisting—allowing authenticated attackers to write arbitrary metadata to user accounts. This vulnerability matters because user metadata in WordPress often controls user roles, capabilities, permissions, and custom application settings. An attacker with basic authentication can escalate privileges, inject malicious serialized objects, or modify application-critical user data without administrator approval. Any WordPress site running the vulnerable Mapster plugin with user registration enabled faces risk, though the impact scales with the plugin's integration into site functionality.

Casky's skill-based detection using Claude AI's extended reasoning maps this vulnerability to MITRE ATT&CK TA0001 (Initial Access via authenticated access) and TA0043 (Resource Development for privilege escalation). Practitioners querying Casky's 323 matching skills would identify attack patterns including: missing input validation checks (CWE-20), authorization bypass detection in plugin hooks, suspicious `update_user_meta()` calls lacking capability guards, and nonce validation failures in user-facing functions. The platform would surface findings showing POST parameter `acf-photo-gallery-groups` flowing directly into metadata operations without sanitization, enabling attackers to modify user roles from subscriber to administrator. Security teams would see this as an authentication-to-escalation pattern, flagging the absence of `current_user_can()` checks and detecting where `wp_verify_nonce()` should exist but doesn't—providing practitioners with the precise code-level indicators and MITRE context needed to prioritize patching and audit their user account integrity.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-12954.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-12954

Casky has 323 skills that investigate the attack patterns behind CVE-2026-12954. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn