CVE-2026-118168
Received Received - Intake

Unauthenticated User Data Exposure in MapPress WordPress Plugin

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: WPScan

Description
The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-118168
EUVD
EUVD-2026-114779

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown MapPress 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-118168 is a vulnerability in the MapPress WordPress plugin versions before 2.97.15. It allows unauthenticated visitors to access sensitive user data through the front-end map embed handler. Attackers can retrieve email addresses and display names of any site user by enumerating user IDs.

Detection Guidance

To detect this vulnerability, check if your MapPress plugin version is below 2.97.15. You can do this by inspecting the plugin files or using WordPress admin panel. Test by accessing the front-end map embed handler with different user IDs to see if it leaks email addresses or display names.

Impact Analysis

This vulnerability allows attackers to collect user email addresses and display names without authentication. This could lead to privacy breaches, targeted phishing attacks, or exposure of sensitive user information. Websites using vulnerable versions are at risk of unauthorized data access.

Compliance Impact

This vulnerability may violate GDPR and other privacy regulations by exposing personal data without consent. Organizations could face fines or legal consequences for failing to protect user information. Immediate patching is recommended to maintain compliance.

Mitigation Strategies

Immediately update the MapPress plugin to version 2.97.15 or later. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Monitor your site for unusual activity or data leaks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118168. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart