Mappress Maps For Wordpress
Monthly
Sensitive data exposure in MapPress Maps for WordPress <= 2.97.6 allows unauthenticated remote attackers to access potentially sensitive information through a vulnerable plugin endpoint. The flaw, assigned CWE-497, permits disclosure of internal data such as configuration details or API keys without any user interaction, facilitating further attacks. No public exploit or active exploitation has been reported at the time of analysis, but the low attack complexity elevates its practical risk.
We need to produce a JSON object for CVE-2026-8839. All fields must be plain text strings. First, compile data. CVE: MapPress Maps for WordPress plugin for WordPress. Authorization bypass through user-controlled key. Missing ownership verification in REST API routes. Vulnerable versions up to and including 2.96.6. CVSS 5.3, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. CWE-639. EPSS 0.08%, percentile 24% (so low). POC publicly available. Reported by Wordfence. Tags: Authentication Bypass, WordPress, Mappress Maps For WordPress. SSVC: Exploitation none, Automatable yes, Technical Impact partial. EUVD: affected versions 0 ≤ 2.96.6. Many references to plugin trac links, showing the vulnerable code: permission_callback => '__return_true' for GET /wp-json/mapp/v1/maps/{mapid} (so read without auth), and write endpoints only check edit_posts capability (requires at least contributor), but no ownership check. Model layer also lacks ownership verification. So unauthenticated read of any map data (sensitive data: POI titles, addresses, coordinates, body content). Authenticated with contributor+ can modify, delete, trash/restore, clone any map. Now we need to synthesize. product_name: "MapPress Maps for WordPress" (1-3 words). summary: Not copy description. Start with impact verb and product. For unauthenticated: "Sensitive information disclosure and unauthorized modification in MapPress Maps for WordPress versions up to 2.96.6 allows unauthenticated attackers to read map data including locations and content, and authenticated contributors to modify, delete, or clone any map." That covers it. Mention EPSS 0.08% low, no active exploitation KEV? No KEV in input, so no active exploitation. But POC publicly available. So summary: "Sensitive information disclosure and unauthorized modification in MapPress Maps for WordPress versions up to 2.96.6 allows unauthenticated attackers to read map data including POI locations and content via the REST API, while authenticated users with co
The MapPress Maps for WordPress plugin before 2.88.16 is affected by an IDOR as it does not ensure that posts to be retrieve via an AJAX action is a public map, allowing unauthenticated users to read. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The MapPress Maps for WordPress plugin before 2.88.15 does not sanitize and escape the map title when outputting it back in the admin dashboard, allowing Contributors and above roles to perform. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Sensitive data exposure in MapPress Maps for WordPress <= 2.97.6 allows unauthenticated remote attackers to access potentially sensitive information through a vulnerable plugin endpoint. The flaw, assigned CWE-497, permits disclosure of internal data such as configuration details or API keys without any user interaction, facilitating further attacks. No public exploit or active exploitation has been reported at the time of analysis, but the low attack complexity elevates its practical risk.
We need to produce a JSON object for CVE-2026-8839. All fields must be plain text strings. First, compile data. CVE: MapPress Maps for WordPress plugin for WordPress. Authorization bypass through user-controlled key. Missing ownership verification in REST API routes. Vulnerable versions up to and including 2.96.6. CVSS 5.3, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. CWE-639. EPSS 0.08%, percentile 24% (so low). POC publicly available. Reported by Wordfence. Tags: Authentication Bypass, WordPress, Mappress Maps For WordPress. SSVC: Exploitation none, Automatable yes, Technical Impact partial. EUVD: affected versions 0 ≤ 2.96.6. Many references to plugin trac links, showing the vulnerable code: permission_callback => '__return_true' for GET /wp-json/mapp/v1/maps/{mapid} (so read without auth), and write endpoints only check edit_posts capability (requires at least contributor), but no ownership check. Model layer also lacks ownership verification. So unauthenticated read of any map data (sensitive data: POI titles, addresses, coordinates, body content). Authenticated with contributor+ can modify, delete, trash/restore, clone any map. Now we need to synthesize. product_name: "MapPress Maps for WordPress" (1-3 words). summary: Not copy description. Start with impact verb and product. For unauthenticated: "Sensitive information disclosure and unauthorized modification in MapPress Maps for WordPress versions up to 2.96.6 allows unauthenticated attackers to read map data including locations and content, and authenticated contributors to modify, delete, or clone any map." That covers it. Mention EPSS 0.08% low, no active exploitation KEV? No KEV in input, so no active exploitation. But POC publicly available. So summary: "Sensitive information disclosure and unauthorized modification in MapPress Maps for WordPress versions up to 2.96.6 allows unauthenticated attackers to read map data including POI locations and content via the REST API, while authenticated users with co
The MapPress Maps for WordPress plugin before 2.88.16 is affected by an IDOR as it does not ensure that posts to be retrieve via an AJAX action is a public map, allowing unauthenticated users to read. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The MapPress Maps for WordPress plugin before 2.88.15 does not sanitize and escape the map title when outputting it back in the admin dashboard, allowing Contributors and above roles to perform. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.