The MapPress Maps for WordPress plugin prior to version 2.97.15 allows an unauthenticated attacker to enumerate any user ID and obtain that user's email address and display name via the public map embed handler. This flaw permits disclosure of private user information without authentication, representing a clear information‑exposure vulnerability. The weakness arises from a lack of access control on the front‑end map rendering endpoint, enabling remote data leakage for all users on the affected site.

Any WordPress site running the MapPress Maps for WordPress plugin before version 2.97.15 is impacted. The vulnerability is present in all installations of the plugin that have not yet been upgraded to the patched release, regardless of whether the site uses default configurations or custom themes.

The CVSS score is not disclosed and the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. However, the flaw can be exploited remotely by any visitor to the site's map embed page, as the attack vector relies on unauthenticated access to a publicly accessible endpoint. Because the attacker only needs to know user IDs, enumeration is straightforward, and once the ID is known the exposure is immediate. The lack of authentication requirements makes the risk high from a confidentiality perspective.