A missing authorization check on a public REST endpoint in the Mapster WP Maps WordPress plugin allows an attacker to retrieve the title and full content of any post regardless of its status. This includes private, draft, pending, or trashed posts that are not intended to be publicly visible. The vulnerability effectively exposes confidential or unpublished content, which could be sensitive or proprietary.

WordPress sites that have the Mapster WP Maps plugin installed with a version earlier than 1.24.0 are affected. The issue specifically involves the plugin's public REST endpoint and does not depend on site configuration beyond the plugin installation.

The exploitability is straightforward: a simple HTTP request to the exposed REST endpoint returns post data without authentication, so no credentials are required. However, the EPSS score of < 1% indicates a very low probability of observation by attackers, and the vulnerability is not listed in CISA's KEV catalog. Despite the low likelihood, the consequence of an uncontrolled disclosure of private or draft content can be significant, particularly for sites that store sensitive material or plan to publish it in the future. The lack of enforcement of post status and permissions directly compromises confidentiality without interfering with system availability or integrity. The CVSS score of 7.5 indicates a high severity risk.