EUVD-2026-49237
GHSA-9v2f-m8x4-gpjm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend unauthenticated HTTP request to vulnerable endpoint
-
ExploitPlugin returns sensitive data without authorization check
-
ImpactAttacker collects exposed API keys or system info for later misuse.
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection System info exposure prevention
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of MapPress Maps for WordPress. The vulnerable endpoint is reachable over the network without any user interaction; only the plugin being active and accessible via HTTP/HTTPS is required. |
| Impact | CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N yields a base score of 5.3 (Medium), driven by high exploitability but only low confidentiality impact. No EPSS score is available, so exploitation probability cannot be quantified; the absence of KEV listing suggests no known in‑the‑wild activity. The vulnerability is trivially exploitable remotely with no privileges, which could attract automated scanning once publicly known. Given the low impact and medium score, prioritization should be weighed against the sensitivity of data the plugin might expose in a specific deployment-if it holds critical API keys or internal paths, risk is elevated. |
| Exploit ScenarioDerived | An attacker sends a crafted HTTP GET request to a publicly accessible endpoint of the MapPress plugin (e.g., an AJAX handler) without any authentication token. The server responds with raw sensitive information-such as Google Maps API keys, database table names, or debugging data-that the attacker can then harvest and use to plan deeper intrusions or escalate privileges. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
Sensitive data exposure in MapPress Maps for WordPress <= 2.97.6 allows unauthenticated remote attackers to access potentially sensitive information through a vulnerable plugin endpoint. The flaw, assigned CWE-497, permits disclosure of internal data such as configuration details or API keys without any user interaction, facilitating further attacks. No public exploit or active exploitation has been reported at the time of analysis, but the low attack complexity elevates its practical risk.
RemediationAI
Immediately update MapPress Maps for WordPress to version 2.97.7 or the latest release that patches this issue. If an immediate update is not feasible, temporarily disable the plugin until the patch is applied. Additionally, restrict access to the plugin's endpoints via a web application firewall (WAF) rule that blocks unauthenticated requests to known sensitive URIs, though this may break intended public functionality. Monitor the vendor's changelog for further details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from improper authorization checks in a WordPress plugin developed by chrisvrichardson (CPE: cpe:2.3:a:chrisvrichardson:mappress_maps_for_wordpress:*:*:*:*:*:wordpress:*:*). It aligns with CWE-497 'Exposure of Sensitive System Information to an Unauthorized Control Sphere', indicating the plugin exposes internal data - such as environment details, debug information, or API keys - through an endpoint accessible without authentication. This is typical of plugins that fail to validate capability requirements on AJAX or REST API handlers, inadvertently leaking information to any network-accessible request.
Know when Mappress Maps For Wordpress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Remote network vector, no privileges or user interaction, limited information disclosure.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress <= 2.97.6 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Mappress Maps For Wordpress
View allThe MapPress Maps for WordPress plugin before 2.88.15 does not sanitize and escape the map title when outputting it back
Authorization bypass in the MapPress Maps for WordPress plugin exposes two distinct attack surfaces: an unauthenticated
The MapPress Maps for WordPress plugin before 2.88.16 is affected by an IDOR as it does not ensure that posts to be retr
Exploit-DB