CVE-2026-88395.3MediumCWE-639

CVE-2026-8839: MapPress Maps for WordPress <= 2.96.6 - Unauthenticated Insecure Direct Object Reference via REST API Endpoints

chrisvrichardson · MapPress Maps for WordPress

Affected: chrisvrichardson MapPress Maps for WordPress · Exploitation: check available, not yet exploited

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

1.0%probability of exploitation in the next 30 days

63rd percentile

050100

Higher than 63% of scored CVEs

5.3MediumCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

The MapPress Maps for WordPress plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 2.96.6. This is due to missing ownership verification in the REST API routes registered via `Mappress_Api::rest_api_init()`, where the GET `/wp-json/mapp/v1/maps/{mapid}` endpoint uses `'permission_callback' => '__return_true'` and the write endpoints (POST update, DELETE, PATCH mutate, POST clone, POST empty_trash) only check the generic `edit_posts` capability without confirming that the requester owns the targeted map — a gap that is not compensated at the model layer, as `Mappress_Map::get()`, `save()`, `delete()`, `mutate()`, and `empty_trash()` all operate on any caller-supplied map ID without an ownership check. This makes it possible for unauthenticated attackers to read sensitive map data — including POI titles, addresses, coordinates, and body content — for any map on the site by enumerating map IDs, and for authenticated attackers with Contributor-level access and above to modify, delete, trash/restore, or clone any map regardless of its author.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

chrisvrichardson · MapPress Maps for WordPressup to and including 2.96.6

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
CISA KEV: Not listed
Public check: WordPress MapPress Maps <= 2.96.6 - Unauthenticated IDOR · nuclei template in projectdiscovery/nuclei-templates
Weakness: Insecure Direct Object Reference
Vendor: chrisvrichardson
Published: June 2026
Band: Check available, not yet exploited, June 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-8839 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.

References

12 more references are in the CVE record.