{"id":"CVE-2026-118168","kind":"vulnerability","aliases":["CVE-2026-118168"],"related":[],"title":"MapPress WordPress plugin leaks user emails and display names to visitors","description":"The MapPress  WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs.","summary":"The MapPress WordPress plugin before 2.97.15 has a front-end map embed handler that renders data for any user without checking who is asking. An unauthenticated visitor can enumerate user IDs and retrieve the email address and display name of any user on the site.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mappress","package","self-hosted","wordpress"],"not_affected_if":["fixed-version","plugin-not-installed"],"how_to_check":"- Check the installed MapPress version in the WordPress admin plugin list; the flaw is in versions before `2.97.15`.","fix":"- MapPress plugin: upgrade to `2.97.15` or later","status":"open","published_at":"2026-11-01T05:18:57+00:00","first_seen_at":"2026-11-01T06:48:24+00:00","triaged_at":"2026-11-01T06:48:59+00:00","updated_at":"2026-11-01T06:48:59+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-01T06:48:59Z","model":"claude-haiku-5-5","output":{"fix":"- MapPress plugin: upgrade to `2.97.15` or later","reach":"internet","title":"MapPress WordPress plugin leaks user emails and display names to visitors","impact":"medium","summary":"The MapPress WordPress plugin before 2.97.15 has a front-end map embed handler that renders data for any user without checking who is asking. An unauthenticated visitor can enumerate user IDs and retrieve the email address and display name of any user on the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","mappress","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Visitors read user email addresses and display names by enumerating IDs","analyst_note":"","how_to_check":"- Check the installed MapPress version in the WordPress admin plugin list; the flaw is in versions before `2.97.15`.\n- unknown","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","fixed-version"],"who_is_affected":"Any WordPress site running the MapPress plugin before 2.97.15 that embeds its map handler on the front end is exposed. The flaw needs no login, so any public visitor can reach it. Sites without the plugin, or running a fixed version, are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000656,"input_tokens":4100,"output_tokens":491,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118168':14A,17A '-2026':13A,16A '2.97.15':29B,75C 'address':60B,98C 'allow':91C 'ask':48B 'check':45B 'cve':12A,15A 'data':40B,82C 'display':8A,62B,100C 'email':6A,59B,97C 'emb':36B,88C 'end':34B,86C 'enumer':53B,109C 'front':33B,85C 'front-end':32B,84C 'handler':37B,89C 'host':22B 'id':55B,111C 'leak':4A 'map':35B,87C 'mappress':1A,18B,25B,71C 'name':9A,63B,101C 'packag':19B 'plugin':3A,27B,73C 'render':39B,90C 'restrict':78C 'retriev':57B,95C 'self':21B 'self-host':20B 'site':69B,107C 'unauthent':50B,92C 'user':5A,43B,54B,66B,80C,104C,110C 'visitor':11A,51B,93C 'without':44B 'wordpress':2A,23B,26B,72C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running the MapPress plugin before 2.97.15 that embeds its map handler on the front end is exposed. The flaw needs no login, so any public visitor can reach it. Sites without the plugin, or running a fixed version, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T05:18:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118168","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118168","severity":null,"published_at":"2026-11-01T05:18:57+00:00","modified_at":"2026-11-01T05:18:57+00:00","first_seen_at":"2026-11-01T06:48:24+00:00","fetched_at":"2026-11-01T06:48:24+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}