CVE-2026-118168: MapPress Maps for WordPress < 2.97.15 - Unauthenticated Email Address Disclosure

Q: Who is exposed to this issue?

WordPress sites using MapPress Maps versions earlier than 2.97.15 are affected. Any unauthenticated visitor can potentially retrieve user email addresses and display names.

Q: What does an attacker need to exploit it?

An attacker needs network access to the affected site and does not need an account or user interaction. Exploitation relies on enumerating WordPress user IDs through the plugin's front-end map embed handler.

Q: What information can be disclosed?

The issue can disclose the email address and display name of any user whose ID can be enumerated. The provided information does not indicate impact to data integrity or availability.

Q: How can I remediate the issue?

Update MapPress Maps to version 2.97.15 or later. The provided data does not identify an alternative mitigation for sites that cannot be updated immediately.

Published Nov 1, 2026

Updated

The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs.

Event History

Nov 1, 2026

CVE Published

via NVD·05:18 AM

Data Sourced

via NVD·05:18 AM

DescriptionSeverityWeakness

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

WordPress sites using MapPress Maps versions earlier than 2.97.15 are affected. Any unauthenticated visitor can potentially retrieve user email addresses and display names.

What does an attacker need to exploit it?

An attacker needs network access to the affected site and does not need an account or user interaction. Exploitation relies on enumerating WordPress user IDs through the plugin's front-end map embed handler.

What information can be disclosed?

The issue can disclose the email address and display name of any user whose ID can be enumerated. The provided information does not indicate impact to data integrity or availability.

How can I remediate the issue?

Update MapPress Maps to version 2.97.15 or later. The provided data does not identify an alternative mitigation for sites that cannot be updated immediately.

CVE-2026-118168: MapPress Maps for WordPress < 2.97.15 - Unauthenticated Email Address Disclosure

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What information can be disclosed?

How can I remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What information can be disclosed?

How can I remediate the issue?