Is CVE-2026-8839 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8839 being exploited in the wild.

How severe is CVE-2026-8839?

Medium severity, with a CVSS score of 5.3, published 6 June 2026.

Which products and versions are affected?

MapPress Maps for WordPress up to, and including, 2.96.6.

Is there a fix for CVE-2026-8839?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8839 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-8839?

Check whether you run MapPress Maps for WordPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8839: MapPress Maps for WordPress authorization bypass in REST API

CVE-2026-8839 · Severity: medium · CVSS 5.3 · Published 2026-06-06

The MapPress Maps plugin for WordPress, which allows users to create and manage interactive maps, contains a security flaw in how it handles map data requests. This vulnerability allows unauthorized individuals to view private map details, such as addresses and coordinates, and allows logged-in users with low-level permissions to modify or delete maps they do not own. This could lead to the exposure of sensitive location data or the disruption of map services on a website.

Technologies: MapPress Maps for WordPress. Vendors: MapPress.

Quick answers

Is CVE-2026-8839 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8839 being exploited in the wild.
How severe is CVE-2026-8839?: Medium severity, with a CVSS score of 5.3, published 6 June 2026.
Which products and versions are affected?: MapPress Maps for WordPress up to, and including, 2.96.6.
Is there a fix for CVE-2026-8839?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8839 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-8839?: Check whether you run MapPress Maps for WordPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The MapPress Maps for WordPress plugin (up to version 2.96.6) fails to perform ownership verification in its REST API routes registered via Mappress_Api::rest_api_init(). The GET endpoint for retrieving maps uses a permission callback that returns true for everyone, while write endpoints (POST, DELETE, PATCH) only check for the generic 'edit_posts' capability without verifying if the user owns the specific map ID. Consequently, unauthenticated attackers can read map data (POI titles, addresses, coordinates) via ID enumeration, and authenticated users with Contributor-level access or higher can modify, delete, or clone any map on the site. The issue is present at both the API and model layers (Mappress_Map class). A fix is available in version 2.97.1.

Affected products

MapPress MapPress Maps for WordPress up to, and including, 2.96.6

Timeline

2026-06-06: disclosed
2026-06-06: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.