PT-2026-47142 · Chrisvrichardson · Mappress Maps For Wordpress

Kitch Global

·

Published

2026-06-06

·

Updated

2026-06-06

·

CVE-2026-8839

CVSS v3.1

5.3

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
The MapPress Maps for WordPress plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 2.96.6. This is due to missing ownership verification in the REST API routes registered via Mappress Api::rest api init(), where the GET /wp-json/mapp/v1/maps/{mapid} endpoint uses 'permission callback' => ' return true' and the write endpoints (POST update, DELETE, PATCH mutate, POST clone, POST empty trash) only check the generic edit posts capability without confirming that the requester owns the targeted map — a gap that is not compensated at the model layer, as Mappress Map::get(), save(), delete(), mutate(), and empty trash() all operate on any caller-supplied map ID without an ownership check. This makes it possible for unauthenticated attackers to read sensitive map data — including POI titles, addresses, coordinates, and body content — for any map on the site by enumerating map IDs, and for authenticated attackers with Contributor-level access and above to modify, delete, trash/restore, or clone any map regardless of its author.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-8839

Affected Products

Mappress Maps For Wordpress