EUVD-2026-49237
GHSA-9v2f-m8x4-gpjm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Remote network vector, no privileges or user interaction, limited information disclosure.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress <= 2.97.6 versions.
AnalysisAI
Sensitive data exposure in MapPress Maps for WordPress <= 2.97.6 allows unauthenticated remote attackers to access potentially sensitive information through a vulnerable plugin endpoint. The flaw, assigned CWE-497, permits disclosure of internal data such as configuration details or API keys without any user interaction, facilitating further attacks. No public exploit or active exploitation has been reported at the time of analysis, but the low attack complexity elevates its practical risk.
Technical ContextAI
The vulnerability stems from improper authorization checks in a WordPress plugin developed by chrisvrichardson (CPE: cpe:2.3:a:chrisvrichardson:mappress_maps_for_wordpress:*:*:*:*:*:wordpress:*:*). It aligns with CWE-497 'Exposure of Sensitive System Information to an Unauthorized Control Sphere', indicating the plugin exposes internal data - such as environment details, debug information, or API keys - through an endpoint accessible without authentication. This is typical of plugins that fail to validate capability requirements on AJAX or REST API handlers, inadvertently leaking information to any network-accessible request.
RemediationAI
Immediately update MapPress Maps for WordPress to version 2.97.7 or the latest release that patches this issue. If an immediate update is not feasible, temporarily disable the plugin until the patch is applied. Additionally, restrict access to the plugin's endpoints via a web application firewall (WAF) rule that blocks unauthenticated requests to known sensitive URIs, though this may break intended public functionality. Monitor the vendor's changelog for further details.
More in Mappress Maps For Wordpress
View allThe MapPress Maps for WordPress plugin before 2.88.15 does not sanitize and escape the map title when outputting it back
We need to produce a JSON object for CVE-2026-8839. All fields must be plain text strings. First, compile data. CVE: Ma
The MapPress Maps for WordPress plugin before 2.88.16 is affected by an IDOR as it does not ensure that posts to be retr
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today