What is the CVSS score of CVE-2026-111397?

CVE-2026-111397 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

MapSVG CVE-2026-111397

EUVD-2026-102858 MEDIUM

Missing Authorization (CWE-862)

2026-10-16 Patchstack

GHSA-3r87-gjf6-xw3g

WordPress Authentication Bypass Information Disclosure Wordpress Plugin Mapsvg

5.3

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify WordPress site running MapSVG ≤8.16.1
Exploit

Send unauthenticated request to unprotected endpoint
Execution

Bypass missing authorization check
Impact

Retrieve embedded sensitive data

Vulnerability Assessment

Weakness	CWE CWE-862 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Authorization checks on every request MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	The target site must be running the MapSVG (mapsvg-lite-interactive-vector-maps) WordPress plugin at version 8.16.1 or earlier, and must have embedded sensitive data stored within MapSVG maps/content for there to be anything meaningful to disclose. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required, so exploitation works against default configurations with only network access to the site. The practical limiting factor is not access control but data exposure scope: impact is confined to confidentiality of data the site operator placed in MapSVG (C:L, no integrity/availability impact), so sites storing only public map data face negligible real impact.
Impact	This is a moderate-severity information disclosure issue (CVSS 5.3, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) stemming from a missing authorization check (CWE-862) in the MapSVG WordPress plugin. The CVSS vector signals favor exploitability: network attack vector, low complexity, and no privileges or user interaction required, meaning any unauthenticated remote attacker can trigger it against default installations. However, the impact is bounded - only confidentiality is affected, and only at Low (C:L), with no integrity or availability impact, so this leaks embedded sensitive data rather than enabling takeover. No EPSS score was provided in the input, the CVE is NOT on CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The signals are internally consistent (easy-to-reach but limited-impact disclosure); the main caveat is that the exact nature and sensitivity of the 'embedded sensitive data' is not detailed, so real-world risk depends on what each site has stored in MapSVG. Treat as a patch-when-practical issue rather than an emergency, prioritizing sites that store sensitive content in maps.
Exploit ScenarioDerived	An unauthenticated attacker sends a crafted request to a vulnerable MapSVG endpoint on a WordPress site running the plugin at version 8.16.1 or earlier, where a missing authorization check allows retrieval of embedded sensitive data without login. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only network reachability to the site and no credentials or victim interaction. No public exploit code is identified at time of analysis, but the low complexity makes reliable exploitation straightforward once the endpoint is known.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 16, 2026

Information disclosure in the MapSVG WordPress plugin (mapsvg-lite-interactive-vector-maps) through version 8.16.1 lets unauthenticated remote attackers retrieve sensitive data that a site has embedded in its MapSVG maps and content, because a missing authorization check (CWE-862) fails to properly gate access to that stored data. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3), no credentials or user interaction are needed and only network reachability to the affected site is required, while impact is confined to confidentiality with no integrity or availability effect and no public exploit identified at time of analysis. Practical risk therefore depends on what operators have placed inside MapSVG content: sites storing only public map data face negligible real impact, whereas those that embedded secrets or private records in map fields should treat this as a live exposure.

RemediationAI

No vendor-released patch version is identified in the available data, so the first step is to check the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/mapsvg-lite-interactive-vector-maps/vulnerability/wordpress-mapsvg-plugin-8-16-1-sensitive-data-exposure-vulnerability?_s_id=cve) and the plugin's WordPress.org page for a fixed release and upgrade to the first version newer than 8.16.1 as soon as it is published. If no fixed release is available and MapSVG is not essential, deactivating and removing the plugin eliminates the exposure entirely, at the cost of losing the interactive maps and any store-locator or directory functionality. If the plugin must stay, apply compensating controls: purge non-public data from MapSVG data objects and custom fields so only information intended for public display remains (this removes the impact even if the authorization gap persists), and add reverse-proxy, WAF, or server rules that block or rate-limit unauthenticated requests to the plugin's data-retrieval endpoints while allowing legitimate page rendering, accepting the trade-off that aggressive blocking can break map loading for normal visitors. Where the site has already been publicly reachable, treat any data previously stored in MapSVG as potentially disclosed and rotate or remove those secrets, and review web logs for enumeration-style requests to plugin endpoints.

Affected VersionsENISA

MapSVG 0 ≤8.16.1

Affected Packages

euvd mapsvg no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

MapSVG is a WordPress plugin that renders interactive vector maps and lets site owners attach custom data objects (locations, directories, store-finder records, and arbitrary custom fields) that are stored and served by the plugin. The root cause is CWE-862 (Missing Authorization): a plugin endpoint or data-retrieval path does not verify that the requester is permitted to read the underlying data, so the authorization decision is effectively skipped rather than enforced. The affected CPE, cpe:2.3:a:pt_norther_lights_production:mapsvg:*:*:*:*:*:*:*:*, uses a wildcard version because the vendor advisory covers all releases from n/a up to and including 8.16.1; the wildcard is not evidence of a broader untested scope. Because the CVSS vector carries PR:N and UI:N, the missing check is reachable over the network without an authenticated session, which is why the issue is tagged as both an authentication bypass and an information-disclosure flaw. The confidentiality-only scoring (C:L, I:N, A:N) reflects that the exposed data is whatever the site operator has stored in MapSVG rather than server-side execution or data modification.

Know when Mapsvg gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI 5.3 MEDIUM

Unauthenticated network-reachable missing-authorization flaw (AV:N/AC:L/PR:N/UI:N) yielding limited data disclosure only, so C:L with I:N/A:N and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

DescriptionCVE.org

Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Retrieve Embedded Sensitive Data.This issue affects MapSVG: from n/a through 8.16.1.

Threat Intelligence Overview

Prevalence

Medium

WordPress interactive-map plugin with a moderate install base, not universal

Social Media

Sightings

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS N/A

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +26

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.