Mappress Maps For Wordpress
Monthly
Sensitive data exposure in MapPress Maps for WordPress <= 2.97.6 allows unauthenticated remote attackers to access potentially sensitive information through a vulnerable plugin endpoint. The flaw, assigned CWE-497, permits disclosure of internal data such as configuration details or API keys without any user interaction, facilitating further attacks. No public exploit or active exploitation has been reported at the time of analysis, but the low attack complexity elevates its practical risk.
Authorization bypass in the MapPress Maps for WordPress plugin exposes two distinct attack surfaces: an unauthenticated REST endpoint that leaks map data including POI titles, physical addresses, and coordinates for any map by ID enumeration, and an authenticated write surface where any Contributor-level user can modify, delete, clone, or trash maps they do not own. All versions through 2.96.6 are affected. No public exploit is confirmed exploited in the wild (not in CISA KEV), though Wordfence has published a public advisory and exploit information is available, and SSVC classifies the write path as automatable.
The MapPress Maps for WordPress plugin before 2.88.16 is affected by an IDOR as it does not ensure that posts to be retrieve via an AJAX action is a public map, allowing unauthenticated users to read. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The MapPress Maps for WordPress plugin before 2.88.15 does not sanitize and escape the map title when outputting it back in the admin dashboard, allowing Contributors and above roles to perform. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Sensitive data exposure in MapPress Maps for WordPress <= 2.97.6 allows unauthenticated remote attackers to access potentially sensitive information through a vulnerable plugin endpoint. The flaw, assigned CWE-497, permits disclosure of internal data such as configuration details or API keys without any user interaction, facilitating further attacks. No public exploit or active exploitation has been reported at the time of analysis, but the low attack complexity elevates its practical risk.
Authorization bypass in the MapPress Maps for WordPress plugin exposes two distinct attack surfaces: an unauthenticated REST endpoint that leaks map data including POI titles, physical addresses, and coordinates for any map by ID enumeration, and an authenticated write surface where any Contributor-level user can modify, delete, clone, or trash maps they do not own. All versions through 2.96.6 are affected. No public exploit is confirmed exploited in the wild (not in CISA KEV), though Wordfence has published a public advisory and exploit information is available, and SSVC classifies the write path as automatable.
The MapPress Maps for WordPress plugin before 2.88.16 is affected by an IDOR as it does not ensure that posts to be retrieve via an AJAX action is a public map, allowing unauthenticated users to read. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The MapPress Maps for WordPress plugin before 2.88.15 does not sanitize and escape the map title when outputting it back in the admin dashboard, allowing Contributors and above roles to perform. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.