CVE-2026-65564
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The MapPress Maps for WordPress plugin version 2.97.6 and earlier exposes sensitive data without authentication. An unauthenticated attacker can access confidential information.
Risk Assessment
The risk includes data leakage, such as API keys or map data, potentially leading to privacy breaches or unauthorized service usage.
Recommendation
Update MapPress Maps for WordPress to a version above 2.97.6 that includes a fix restricting data access.
Other vulnerabilities in MapPress Maps for WordPress
See all- CVE-2026-56011High
The vulnerability allows an unauthenticated attacker to execute XSS scripts in the MapPress Maps plugin for WordPress versions up to and including 2.97.3.
- CVE-2026-8839Medium
The MapPress Maps plugin for WordPress up to version 2.96.6 has an authorization bypass in the REST API. Missing ownership verification allows unauthenticated attackers to read map data (titles, addresses, coordinates, body content) and authenticated attackers (Contributor and above) to modify, delete, or clone any map.
Original NVD description (English source)
Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress <= 2.97.6 versions.