---
id: "CVE-2026-111397"
kind: "vulnerability"
aliases: ["CVE-2026-111397"]
title: "MapSVG Lite WordPress plugin: missing authorization exposes embedded sensitive data"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mapsvg", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-16T13:16:55+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T04:27:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111397", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# MapSVG Lite WordPress plugin: missing authorization exposes embedded sensitive data

The MapSVG Lite interactive vector maps plugin, made by PT Norther Lights Production, lacks an authorization check that lets requests retrieve sensitive data embedded in maps. Versions through 8.16.1 are affected according to NVD.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed MapSVG version in the plugin list or the plugin's main file header, looking for a version at or below `8.16.1`
- unknown

## Fix

- Update MapSVG to a version newer than `8.16.1` once the vendor publishes one; the sources do not name a fixed version
- unknown

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111397

## From the sources

Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Retrieve Embedded Sensitive Data.This issue affects MapSVG: from n/a through 8.16.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_