MapPress Maps for WordPress CVE-2026-65564

No special conditions - remote unauthenticated exploitation against default configurations of MapPress Maps for WordPress. The vulnerable endpoint is reachable over the network without any user interaction; only the plugin being active and accessible via HTTP/HTTPS is required.

CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N yields a base score of 5.3 (Medium), driven by high exploitability but only low confidentiality impact. No EPSS score is available, so exploitation probability cannot be quantified; the absence of KEV listing suggests no known in‑the‑wild activity. The vulnerability is trivially exploitable remotely with no privileges, which could attract automated scanning once publicly known. Given the low impact and medium score, prioritization should be weighed against the sensitivity of data the plugin might expose in a specific deployment-if it holds critical API keys or internal paths, risk is elevated.

An attacker sends a crafted HTTP GET request to a publicly accessible endpoint of the MapPress plugin (e.g., an AJAX handler) without any authentication token. The server responds with raw sensitive information-such as Google Maps API keys, database table names, or debugging data-that the attacker can then harvest and use to plan deeper intrusions or escalate privileges.