CVE-2024-9235: 
WordPress vulnerability analysis and mitigation

The Mapster WP Maps plugin for WordPress contains a privilege escalation vulnerability (CVE-2024-9235) discovered in versions up to and including 1.5.0. The vulnerability was disclosed on October 24, 2024, and affects the mapster_wp_maps_set_option_from_js() function due to insufficient capability checks (NVD).

The vulnerability stems from an insufficient capability check in the mapster_wp_maps_set_option_from_js() function. The function only verifies if users have 'edit_posts' capability, which is available to contributor-level users and above. This allows authenticated attackers with contributor access to update arbitrary WordPress options on the site. The vulnerability has been assigned a CVSS v3.1 score of 8.8 (High) (NVD, Wordfence).

The vulnerability allows authenticated attackers with contributor-level access to modify WordPress site options. Specifically, attackers can update the default role for new user registrations to administrator and enable user registration, effectively gaining administrative access to the vulnerable site (NVD).

Site administrators should update to a version newer than 1.5.0 of the Mapster WP Maps plugin. The vulnerability has been patched in subsequent releases (WordPress Plugin).