MapPress Maps for WordPress <= 2.96.6 Unauthenticated IDOR via REST API (CVE-2026-8839)

Vulnerability Overview Vulnerability Name: MapPress Maps for WordPress <= 2.96.6 - Unauthenticated Insecure Direct Object Reference via REST API Endpoints CVE ID: CVE-2026-8839 CVSS Score: 5.3 (Medium) Published Date: June 5, 2026 Last Updated: June 6, 2026 Researcher: Kitch - KitchGlobal Impact Scope Software Type: Plugin Software Name: MapPress Maps for WordPress Affected Versions: <= 2.96.6 Fixed Version: 2.97.1 Remediation Remediation Measure: Upgrade to version 2.97.1 or later. Vulnerability Description The MapPress Maps for WordPress plugin, in versions 2.96.6 and earlier, contains an authorization bypass vulnerability controlled by user-supplied keys. This is due to a lack of ownership verification in the REST API routes. Specifically, the GET endpoint uses , while write endpoints (POST update, DELETE, PATCH, mutate, POST clone, POST empty/delete) only check for the capability, without confirming whether the requester owns the target map. This allows unauthorized attackers to read sensitive map data (including POI titles, addresses, coordinates, and body content), as well as modify, delete, restore/clone any map, regardless of its author. References plugins.trac.wordpress.org Additional Information Software Type: Plugin Software Name: MapPress Maps for WordPress Affected Versions: <= 2.96.6 Fixed Version: 2.97.1 Recent Vulnerabilities CVE-2025-2162: MapPress Maps for WordPress <= 2.94.9 - Authenticated (Administrator) Stored Cross-Site Scripting CVE-2025-2055: MapPress Maps for WordPress <= 2.94.8 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-10715: MapPress Maps for WordPress <= 2.94.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Block CVE-2024-8620: MapPress Maps for WordPress <= 2.92.2 - Authenticated (Administrator) Stored Cross-Site Scripting CVE-2023-7225: MapPress Maps <= 2.88.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Settings CVE-2024-0420: MapPress Maps for WordPress <= 2.88.14 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-0421: MapPress Maps for WordPress <= 2.88.15 - Insufficient Authorization to Information Disclosure CVE-2023-6524: MapPress Maps for WordPress <= 2.88.13 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2023-4840: MapPress Maps for WordPress <= 2.88.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2023-26015: MapPress Maps for WordPress <= 2.85.4 - Authenticated (Contributor+) SQL Injection via get_maps Summary The MapPress Maps for WordPress plugin, in versions 2.96.6 and earlier, contains an unauthenticated Insecure Direct Object Reference vulnerability, allowing attackers to read and modify sensitive map data via REST API endpoints. It is recommended to upgrade to version 2.97.1 or later to resolve this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

MapPress Maps for WordPress <= 2.96.6 Unauthenticated IDOR via REST API (CVE-2026-8839)