---
id: "CVE-2026-118168"
kind: "vulnerability"
aliases: ["CVE-2026-118168"]
title: "MapPress WordPress plugin leaks user emails and display names to visitors"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mappress", "package", "self-hosted", "wordpress"]
not_affected_if: ["fixed-version", "plugin-not-installed"]
published_at: "2026-11-01T05:18:57+00:00"
first_seen_at: "2026-11-01T06:48:24+00:00"
updated_at: "2026-11-01T06:48:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118168", "first_seen_at": "2026-11-01T06:48:24+00:00"}]
---

# MapPress WordPress plugin leaks user emails and display names to visitors

The MapPress WordPress plugin before 2.97.15 has a front-end map embed handler that renders data for any user without checking who is asking. An unauthenticated visitor can enumerate user IDs and retrieve the email address and display name of any user on the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed MapPress version in the WordPress admin plugin list; the flaw is in versions before `2.97.15`.

## Fix

- MapPress plugin: upgrade to `2.97.15` or later

## Timeline

- 2026-11-01T06:48:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118168

## From the sources

The MapPress  WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_