{"id":"CVE-2026-111397","kind":"vulnerability","aliases":["CVE-2026-111397"],"related":[],"title":"MapSVG Lite WordPress plugin: missing authorization exposes embedded sensitive data","description":"Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Retrieve Embedded Sensitive Data.This issue affects MapSVG: from n/a through 8.16.1.","summary":"The MapSVG Lite interactive vector maps plugin, made by PT Norther Lights Production, lacks an authorization check that lets requests retrieve sensitive data embedded in maps. Versions through 8.16.1 are affected according to NVD.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mapsvg","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed MapSVG version in the plugin list or the plugin's main file header, looking for a version at or below `8.16.1`\n- unknown","fix":"- Update MapSVG to a version newer than `8.16.1` once the vendor publishes one; the sources do not name a fixed version\n- unknown","status":"open","published_at":"2026-10-16T13:16:55+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:27:19+00:00","updated_at":"2026-10-25T04:27:19+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:27:19Z","model":"claude-haiku-5-5","output":{"fix":"- Update MapSVG to a version newer than `8.16.1` once the vendor publishes one; the sources do not name a fixed version\n- unknown","reach":"internet","title":"MapSVG Lite WordPress plugin: missing authorization exposes embedded sensitive data","impact":"medium","summary":"The MapSVG Lite interactive vector maps plugin, made by PT Norther Lights Production, lacks an authorization check that lets requests retrieve sensitive data embedded in maps. Versions through 8.16.1 are affected according to NVD.","category":"package","nicknames":[],"who_cares":["wordpress","mapsvg","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Sensitive data embedded in maps can be read by outside requests","analyst_note":"Check the NVD entry and the vendor or WordPress plugin advisory for the fixed version and which embedded data is exposed.","how_to_check":"- Check the installed MapSVG version in the plugin list or the plugin's main file header, looking for a version at or below `8.16.1`\n- unknown","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the MapSVG plugin at version `8.16.1` or earlier that embed maps containing data they do not want public. The sources do not say which configuration or request path is needed to reach the data. Sites without the plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000599,"input_tokens":3315,"output_tokens":536,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111397':13A,16A '-2026':12A,15A '8.16.1':51B,83C 'accord':54B 'affect':53B,78C 'allow':72C 'author':6A,38B,58C 'check':39B 'cve':11A,14A 'data':10A,45B 'data.this':76C 'embed':8A,46B,74C 'expos':7A 'host':21B 'interact':26B,69C 'issu':77C 'lack':36B 'let':41B 'light':34B,63C 'lite':2A,25B,68C 'made':30B 'map':28B,48B,71C 'mapsvg':1A,17B,24B,65C,67C,79C 'mapsvg-lite-interactive-vector-map':66C 'miss':5A,57C 'n/a':81C 'norther':33B,62C 'nvd':56B 'packag':18B 'plugin':4A,29B 'product':35B,64C 'pt':32B,61C 'request':42B 'retriev':43B,73C 'self':20B 'self-host':19B 'sensit':9A,44B,75C 'vector':27B,70C 'version':49B 'vulner':59C 'wordpress':3A,22B","nicknames":[],"mitigations":[],"who_affected":"Sites running the MapSVG plugin at version `8.16.1` or earlier that embed maps containing data they do not want public. The sources do not say which configuration or request path is needed to reach the data. Sites without the plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T13:16:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111397","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111397","severity":null,"published_at":"2026-10-16T13:16:55+00:00","modified_at":"2026-10-16T15:19:36+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}