Authorization Bypass Vulnerability in MapPress Maps for WordPress Plugin

CVE-2026-8839

What is CVE-2026-8839?

The MapPress Maps for WordPress plugin contains a vulnerability that enables unauthorized access to sensitive map data across all versions up to 2.96.6. This flaw arises from the lack of ownership verification in the REST API routes, particularly affecting the GET /wp-json/mapp/v1/maps/{mapid} endpoint, which allows unauthenticated attackers to read sensitive map information. Additionally, attackers with Contributor-level access can modify and delete any map without proper ownership checks, thereby jeopardizing data integrity and privacy on affected websites.

References