CVE-2026-12954 is an improper input validation vulnerability (CWE-20) in the Mapster WP Maps plugin for WordPress, affecting all versions up to and including 1.23.0. The vulnerability arises because the my_profile_update() function accepts a meta key via the acf-photo-gallery-groups POST parameter and directly passes it along with its value to update_user_meta() without verifying the nonce, checking user capabilities, or validating the meta key against an allowlist. This enables authenticated attackers with Subscriber-level access or higher to arbitrarily modify user meta data. Privilege escalation is not possible through this vulnerability.

An attacker with authenticated access at Subscriber level or above can modify arbitrary user meta values, potentially affecting user data integrity and application behavior. However, the vulnerability does not permit privilege escalation or direct takeover of higher privileged accounts. The CVSS 3.1 base score is 8.8 (High), reflecting the ease of exploitation and the impact on confidentiality, integrity, and availability.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to trusted users only and monitor for suspicious activity related to user meta modifications. Implement custom nonce verification and capability checks in the my_profile_update() function as a temporary mitigation.