Executive brief
The MapPress Maps plugin for WordPress, which allows users to create and manage interactive maps, contains a security flaw in how it handles map data requests. This vulnerability allows unauthorized individuals to view private map details, such as addresses and coordinates, and allows logged-in users with low-level permissions to modify or delete maps they do not own. This could lead to the exposure of sensitive location data or the disruption of map services on a website.
Technical details
The MapPress Maps for WordPress plugin (up to version 2.96.6) fails to perform ownership verification in its REST API routes registered via Mappress_Api::rest_api_init(). The GET endpoint for retrieving maps uses a permission callback that returns true for everyone, while write endpoints (POST, DELETE, PATCH) only check for the generic 'edit_posts' capability without verifying if the user owns the specific map ID. Consequently, unauthenticated attackers can read map data (POI titles, addresses, coordinates) via ID enumeration, and authenticated users with Contributor-level access or higher can modify, delete, or clone any map on the site. The issue is present at both the API and model layers (Mappress_Map class). A fix is available in version 2.97.1.
Affected products
- MapPress MapPress Maps for WordPress up to, and including, 2.96.6
Timeline
- 2026-06-06: disclosed
- 2026-06-06: advisory
References
- https://plugins.trac.wordpress.org/browser/mappress-google-maps-for-wordpress/tags/2.95.10/mappress_api.php
- https://plugins.trac.wordpress.org/browser/mappress-google-maps-for-wordpress/tags/2.95.10/mappress_api.php
- https://plugins.trac.wordpress.org/browser/mappress-google-maps-for-wordpress/tags/2.95.10/mappress_api.php
- https://plugins.trac.wordpress.org/browser/mappress-google-maps-for-wordpress/tags/2.95.10/mappress_api.php
- https://plugins.trac.wordpress.org/browser/mappress-google-maps-for-wordpress/tags/2.95.10/mappress_api.php
- https://plugins.trac.wordpress.org/browser/mappress-google-maps-for-wordpress/tags/2.95.10/mappress_api.php
- https://plugins.trac.wordpress.org/browser/mappress-google-maps-for-wordpress/tags/2.95.10/mappress_api.php