MapPress CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM MapPress CVE published 2026-11-01

CVE-2026-118168

The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs. This vulnerability allows unauthenticated access to user data, which can lead to potential unauthorized access to user email addresses and display names, en [truncated]