WordPress Plugin Vulnerabilities

MapPress Maps for WordPress < 2.97.15 - Unauthenticated Email Address Disclosure

Description

The plugin does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs.

Proof of Concept

Affects Plugins

Plugin icon
mappress-google-maps-for-wordpress
Fixed in 2.97.15

References

CVE
CVE-2026-118168

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
vuxvinh
Submitter
vuxvinh
Verified
Yes
WPVDB ID
ce9f0060-1054-41ca-9543-1508547aab27

Timeline

Publicly Published
2026-10-30 (about 2 days ago)
Added
2026-10-30 (about 1 day ago)
Last Updated
2026-10-30 (about 1 day ago)

Other

Published
Title
Published
2025-02-11
Title
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin < 1.0.6 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
Published
2024-03-28
Title
Paid Memberships Pro – Payfast Gateway Add On < 1.4.2 - Unauthenticated Information Exposure
Published
2026-05-19
Title
Slider Revolution < 7.0.10 - Unauthenticated Sensitive Information Exposure via 'sliders/stream'
Published
2025-12-11
Title
Guest Support < 1.3.0 - Unauthenticated User Email Disclosure in guest_support_handler AJAX Endpoint
Published
2025-01-06
Title
Link Whisper Free < 0.7.9 - Unauthenticated Sensitive Information Exposure