CVE-2026-118168

MapPress Maps for WordPress < 2.97.15 - Unauthenticated Email Address Disclosure

The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs.

Affected

MapPress

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.20% chance of exploitation in the next 30 days, 10th percentile

Published

2026-11-01

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/ce9f0060-1054-41ca-9543-1508547aab27/snapshot

CVE references

• https://wpscan.com/vulnerability/ce9f0060-1054-41ca-9543-1508547aab27REFERENCE

References

• CVE Record
• NVD entry