MapPress CVE-2026-118168

Exploitation requires that the site run MapPress (versions before 2.97.15) with its front-end map embed feature exposed, which is its normal purpose, so the primary prerequisite is simply that a vulnerable version is installed and serving map embeds publicly. No authentication, user interaction, or special configuration is needed (AV:N/AC:L/PR:N/UI:N), making default deployments exploitable by any remote visitor. The practical limiting factors are: impact is confined to disclosure of user email addresses and display names (no passwords, no code execution, no data modification per C:L/I:N/A:N), and value scales with the number of registered users on the site - a site with few or only administrative accounts yields little, while a membership/community site exposes a large PII set.

This is a genuine but modest-priority issue, not a high-severity emergency. The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N) correctly reflects an unauthenticated, network-reachable information disclosure with only low confidentiality impact and no integrity or availability impact (C:L/I:N/A:N), matching the CWE-200 classification. The signals are internally consistent and point to low-to-moderate real-world risk: EPSS is very low at 0.14% (3rd percentile), SSVC records Exploitation as 'none' (no observed exploitation) with Technical Impact 'partial', and the vulnerability is NOT on CISA KEV. The one aggravating signal is SSVC Automatable:yes - consistent with the description's user-ID enumeration, which can be scripted to harvest all user emails and display names at scale. A public PoC reference exists (WPScan) but it is not verified as working exploit code. The vendor-assigned priority label is 'this_month', aligning with a patch-at-normal-cadence posture rather than immediate action. Net: a real, easily automatable privacy/data-exposure flaw that leaks PII (emails, display names) but grants no code execution or write access - remediate on a normal patch cycle, with some urgency where harvested emails feed phishing or credential-stuffing.

An unauthenticated attacker scripts requests to the MapPress front-end map embed handler, iterating over sequential user IDs, and collects the email address and display name returned for each valid user. Given CVSS AV:N/AC:L/PR:N/UI:N the request requires no authentication, no user interaction, and low complexity, and SSVC marks it Automatable, so the whole site's user roster can be scraped in bulk. A public PoC reference exists (WPScan); it is not verified as working exploit code.