Technical impact
The vulnerability resides in the REST API endpoints of the MapPress Maps for WordPress plugin, where ownership validation is omitted. An attacker can enumerate map identifiers and read detailed information—such as names, addresses, coordinates, and map descriptions—without any authentication. Users with low‑privilege roles such as Contributor are able to update, delete, clone, and manipulate any map regardless of ownership. This breach of access control permits data leakage and unauthorized modification of map assets.
Affected Systems
The plug‑in vendor "chrisvrichardson" provides the product "MapPress Maps for WordPress". Versions up to and including 2.96.6 are vulnerable. Site administrators should verify the plugin version and upgrade if it falls within this range.
Risk and Exploitability
The CVSS score of 5.3 indicates a moderate severity, yet the lack of authentication on read paths means the risk of data exposure is significant. The EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, but the attack vector is likely straightforward—an attacker can issue HTTP requests to the exposed REST endpoints without credentials or with minimal Contributor permissions. Because no ownership checks exist in the model layer, exploitation does not depend on complex prerequisites beyond map ID enumeration or possessing basic editing rights.
