The MapSVG plugin for WordPress contains a missing authorization flaw that allows an attacker to retrieve embedded sensitive data. The issue is caused by a failure to enforce access controls on certain data retrieval functions, leading to disclosure of information that should be restricted. The weakness is classified as CWE‑862, which represents a failure to control access to a resource.

WordPress sites using PT Norther Lights Production’s MapSVG mapsvg‑lite‑interactive‑vector‑maps plugin, versions up to and including 8.16.1, are impacted. Any site that has installed this plugin without upgrading to 8.16.2 or later is potentially vulnerable.

The CVSS score of 5.3 indicates a moderate risk level. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation yet. The likely attack vector is through the plugin’s exposed data retrieval endpoints; it requires no special privileges beyond the ability to access the site’s URLs, but the absence of an explicit attack vector in the description means it may be inferred that unauthenticated or low‑privilege users can exploit the flaw to extract sensitive data.