CVE-2026-118168 MapPress CVE debrief

Who should care

Defenders managing WordPress sites with the MapPress plugin should assess exposure and prioritize verification of plugin versions and access controls. They should also review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

The MapPress plugin vulnerability allows unauthenticated access to user data, requiring defenders to verify exposure and prioritize access controls.

• Potential unauthorized access to user email addresses and display names
• Enumeration of user IDs to retrieve sensitive information
• Required verification of plugin version and access controls
• Potential impact on user privacy and site security

Technical summary

The MapPress WordPress plugin before 2.97.15 does not restrict access to user data in its front-end map embed handler, allowing unauthenticated visitors to retrieve email addresses and display names by enumerating user IDs. This vulnerability can lead to potential unauthorized access to user data, and defenders should prioritize verifying exposure of MapPress plugin versions before 2.97.15 and restrict access to user data. The vulnerability allows unauthenticated access to user data, which can lead to potential unauthorized access to user email addresses and display names.

Defensive priority

Defenders should prioritize verifying exposure of MapPress plugin versions before 2.97.15 and restrict access to user data.

Recommended defensive actions

• Verify MapPress plugin version and restrict access to user data
• Implement access controls for front-end map embed handler
• Monitor for potential enumeration of user IDs
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but user data exposure requires verification. Defenders should verify the plugin version and restrict access to user data. The vulnerability allows unauthenticated access to user data, which can lead to potential unauthorized access to user email addresses and display names.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.