Live › vulnerability › CVE-2026-118168
The MapPress WordPress plugin before 2.97.15 has a front-end map embed handler that renders data for any user without checking who is asking. An unauthenticated visitor can enumerate user IDs and retrieve the email address and display name of any user on the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 06:48 UTC. All times on this page are UTC.
Any WordPress site running the MapPress plugin before 2.97.15 that embeds its map handler on the front end is exposed. The flaw needs no login, so any public visitor can reach it. Sites without the plugin, or running a fixed version, are not affected.
No product ranges from the sources yet.
2.97.15.2.97.15 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs.
This page as .md · .json · in your agent: get_signal("CVE-2026-118168")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.