EUVD-2026-34957
GHSA-4m8c-59q5-hc8f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The MapPress Maps for WordPress plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 2.96.6. This is due to missing ownership verification in the REST API routes registered via Mappress_Api::rest_api_init(), where the GET /wp-json/mapp/v1/maps/{mapid} endpoint uses 'permission_callback' => '__return_true' and the write endpoints (POST update, DELETE, PATCH mutate, POST clone, POST empty_trash) only check the generic edit_posts capability without confirming that the requester owns the targeted map - a gap that is not compensated at the model layer, as Mappress_Map::get(), save(), delete(), mutate(), and empty_trash() all operate on any caller-supplied map ID without an ownership check. This makes it possible for unauthenticated attackers to read sensitive map data - including POI titles, addresses, coordinates, and body content - for any map on the site by enumerating map IDs, and for authenticated attackers with Contributor-level access and above to modify, delete, trash/restore, or clone any map regardless of its author.
AnalysisAI
We need to produce a JSON object for CVE-2026-8839. All fields must be plain text strings.
First, compile data. CVE: MapPress Maps for WordPress plugin for WordPress. Authorization bypass through user-controlled key. Missing ownership verification in REST API routes. Vulnerable versions up to and including 2.96.6. CVSS 5.3, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. CWE-639. EPSS 0.08%, percentile 24% (so low). POC publicly available. Reported by Wordfence. Tags: Authentication Bypass, WordPress, Mappress Maps For WordPress. SSVC: Exploitation none, Automatable yes, Technical Impact partial. EUVD: affected versions 0 ≤ 2.96.6. Many references to plugin trac links, showing the vulnerable code: permission_callback => '__return_true' for GET /wp-json/mapp/v1/maps/{mapid} (so read without auth), and write endpoints only check edit_posts capability (requires at least contributor), but no ownership check. Model layer also lacks ownership verification. So unauthenticated read of any map data (sensitive data: POI titles, addresses, coordinates, body content). Authenticated with contributor+ can modify, delete, trash/restore, clone any map.
Now we need to synthesize. product_name: "MapPress Maps for WordPress" (1-3 words). summary: Not copy description. Start with impact verb and product. For unauthenticated: "Sensitive information disclosure and unauthorized modification in MapPress Maps for WordPress versions up to 2.96.6 allows unauthenticated attackers to read map data including locations and content, and authenticated contributors to modify, delete, or clone any map." That covers it. Mention EPSS 0.08% low, no active exploitation KEV? No KEV in input, so no active exploitation. But POC publicly available. So summary: "Sensitive information disclosure and unauthorized modification in MapPress Maps for WordPress versions up to 2.96.6 allows unauthenticated attackers to read map data including POI locations and content via the REST API, while authenticated users with co
More in Mappress Maps For Wordpress
View allThe MapPress Maps for WordPress plugin before 2.88.15 does not sanitize and escape the map title when outputting it back
The MapPress Maps for WordPress plugin before 2.88.16 is affected by an IDOR as it does not ensure that posts to be retr
Sensitive data exposure in MapPress Maps for WordPress <= 2.97.6 allows unauthenticated remote attackers to access poten
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today