Junglewise Threat Intelligence

CVE-2026-8839: MapPress Maps for WordPress authorization bypass in REST API

CVE-2026-8839 · Severity: medium · CVSS 5.3 · Published 2026-06-06

Technologies: MapPress Maps for WordPress. Vendors: MapPress.

Executive brief

The MapPress Maps plugin for WordPress, which allows users to create and manage interactive maps, contains a security flaw in how it handles map data requests. This vulnerability allows unauthorized individuals to view private map details, such as addresses and coordinates, and allows logged-in users with low-level permissions to modify or delete maps they do not own. This could lead to the exposure of sensitive location data or the disruption of map services on a website.

Technical details

The MapPress Maps for WordPress plugin (up to version 2.96.6) fails to perform ownership verification in its REST API routes registered via Mappress_Api::rest_api_init(). The GET endpoint for retrieving maps uses a permission callback that returns true for everyone, while write endpoints (POST, DELETE, PATCH) only check for the generic 'edit_posts' capability without verifying if the user owns the specific map ID. Consequently, unauthenticated attackers can read map data (POI titles, addresses, coordinates) via ID enumeration, and authenticated users with Contributor-level access or higher can modify, delete, or clone any map on the site. The issue is present at both the API and model layers (Mappress_Map class). A fix is available in version 2.97.1.

Affected products

  • MapPress MapPress Maps for WordPress up to, and including, 2.96.6

Timeline

  • 2026-06-06: disclosed
  • 2026-06-06: advisory

References

Related threats