CVE-2026-8839
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
The MapPress Maps plugin for WordPress up to version 2.96.6 has an authorization bypass in the REST API. Missing ownership verification allows unauthenticated attackers to read map data (titles, addresses, coordinates, body content) and authenticated attackers (Contributor and above) to modify, delete, or clone any map.
Risk Assessment
Attackers can steal sensitive geolocation data and take control of maps, leading to privacy breaches and content integrity issues.
Recommendation
Update the MapPress Maps plugin to the latest version that includes authorization fixes.
Other vulnerabilities in MapPress Maps for WordPress
See all- CVE-2026-65564Medium
The MapPress Maps for WordPress plugin version 2.97.6 and earlier exposes sensitive data without authentication. An unauthenticated attacker can access confidential information.
- CVE-2026-56011High
The vulnerability allows an unauthenticated attacker to execute XSS scripts in the MapPress Maps plugin for WordPress versions up to and including 2.97.3.
Original NVD description (English source)
The MapPress Maps for WordPress plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 2.96.6. This is due to missing ownership verification in the REST API routes registered via `Mappress_Api::rest_api_init()`, where the GET `/wp-json/mapp/v1/maps/{mapid}` endpoint uses `'permission_callback' => '__return_true'` and the write endpoints (POST update, DELETE, PATCH mutate, POST clone, POST empty_trash) only check the generic `edit_posts` capability without confirming that the requester owns the targeted map — a gap that is not compensated at the model layer, as `Mappress_Map::get()`, `save()`, `delete()`, `mutate()`, and `empty_trash()` all operate on any caller-supplied map ID without an ownership check. This makes it possible for unauthenticated attackers to read sensitive map data — including POI titles, addresses, coordinates, and body content — for any map on the site by enumerating map IDs, and for authenticated attackers with Contributor-level access and above to modify, delete, trash/restore, or clone any map regardless of its author.