EUVD-2026-34957
GHSA-4m8c-59q5-hc8f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEnumerate sequential mapids via open GET REST endpoint
-
DeliveryHarvest POI addresses and coordinates unauthenticated
-
ExploitAuthenticate as Contributor-level WordPress user
-
ExecutionSubmit DELETE/PATCH/clone REST request with victim map ID
-
PersistPlugin checks edit_posts only, skips ownership verification
-
ImpactVictim's map deleted or overwritten
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Two distinct exploitation conditions exist. For the unauthenticated read path: no special conditions - any HTTP client can issue GET requests to |
| Impact | The official CVSS 5.3 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) captures only the unauthenticated write surface and misrepresents the confidentiality impact as N when the unauthenticated GET endpoint demonstrably exposes map content (POI titles, addresses, coordinates, body content) - C:L is more accurate for that path. The authenticated write path (Contributor+) is materially more severe, enabling deletion or modification of any map on the site, which represents I:H impact. SSVC assessment marks the vulnerability as Automatable:yes, making mass enumeration or scripted modification viable. EPSS at 0.08% (24th percentile) and no KEV listing indicate no confirmed widespread exploitation at time of analysis. The combination of a publicly available Wordfence advisory, automatable exploitation, and the ubiquity of Contributor-level WordPress accounts (which are frequently compromised or maliciously registered) elevates real-world risk above what the CVSS score alone suggests, particularly for multi-author WordPress sites. |
| Exploit ScenarioDerived | An unauthenticated attacker scripts sequential GET requests to |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Authorization bypass in the MapPress Maps for WordPress plugin exposes two distinct attack surfaces: an unauthenticated REST endpoint that leaks map data including POI titles, physical addresses, and coordinates for any map by ID enumeration, and an authenticated write surface where any Contributor-level user can modify, delete, clone, or trash maps they do not own. All versions through 2.96.6 are affected. No public exploit is confirmed exploited in the wild (not in CISA KEV), though Wordfence has published a public advisory and exploit information is available, and SSVC classifies the write path as automatable.
RemediationAI
No vendor-released patched version is identified in the available data - the newest source code referenced is version 2.96.6, which remains vulnerable. Site operators should check the WordPress plugin repository for a version newer than 2.96.6 and apply it immediately if available. As a compensating control pending a patch, administrators can disable REST API access to the MapPress endpoints by adding a custom permission_callback that enforces ownership, or by blocking access to /wp-json/mapp/v1/maps/ at the web server or WAF layer - note that this will break any frontend map-loading that depends on the REST API. Additionally, restricting Contributor-level user registration on multi-author sites reduces the attack surface for the write path. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/9f402aa7-24d6-448b-a1d3-5ee7c90b39bc for patch availability updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the REST API implementation registered by Mappress_Api::rest_api_init() in the MapPress Maps for WordPress WordPress plugin (CPE: cpe:2.3:a:chrisvrichardson:mappress_maps_for_wordpress). CWE-639 (Authorization Bypass Through User-Controlled Key) describes the root cause precisely: the map ID - a caller-supplied integer - acts as the sole authorization key, but no ownership check gates its use. The GET /wp-json/mapp/v1/maps/{mapid} endpoint is registered with permission_callback => __return_true, meaning WordPress imposes no access control whatsoever. The write endpoints (POST update, DELETE, PATCH mutate, POST clone, POST empty_trash) check only the generic edit_posts capability, confirming the requester can edit *some* post - but never confirming they authored the targeted map. Critically, this gap is not closed at the model layer: Mappress_Map::get(), save(), delete(), mutate(), and empty_trash() all accept any caller-supplied map ID without ownership validation, as confirmed by source code references at mappress_api.php and mappress_map.php in the plugin's SVN repository.
Know when Mappress Maps For Wordpress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Contributor-level auth required for write path (PR:L); unauthenticated read exposes map data (C:L); deletion/modification of any map is I:H; trashing maps causes A:L.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The MapPress Maps for WordPress plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 2.96.6. This is due to missing ownership verification in the REST API routes registered via Mappress_Api::rest_api_init(), where the GET /wp-json/mapp/v1/maps/{mapid} endpoint uses 'permission_callback' => '__return_true' and the write endpoints (POST update, DELETE, PATCH mutate, POST clone, POST empty_trash) only check the generic edit_posts capability without confirming that the requester owns the targeted map - a gap that is not compensated at the model layer, as Mappress_Map::get(), save(), delete(), mutate(), and empty_trash() all operate on any caller-supplied map ID without an ownership check. This makes it possible for unauthenticated attackers to read sensitive map data - including POI titles, addresses, coordinates, and body content - for any map on the site by enumerating map IDs, and for authenticated attackers with Contributor-level access and above to modify, delete, trash/restore, or clone any map regardless of its author.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Mappress Maps For Wordpress
View allThe MapPress Maps for WordPress plugin before 2.88.15 does not sanitize and escape the map title when outputting it back
The MapPress Maps for WordPress plugin before 2.88.16 is affected by an IDOR as it does not ensure that posts to be retr
Sensitive data exposure in MapPress Maps for WordPress <= 2.97.6 allows unauthenticated remote attackers to access poten
Exploit-DB