CVE-2026-118168— MapPress Maps for WordPress < 2.97.15 - Unauthenticated Email Address Disclosure

Quick assessment

Affected

Unknown MapPress

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 2.97.15 版本之前，MapPress WordPress 插件的前端地图嵌入处理器未对用户数据的访问进行限制，导致未认证的访客可以通过枚举用户 ID 来获取并显示网站上任何用户的电子邮件地址和显示名称。

AI Predicted 5.3 Difficulty: Trivial EPSS 0.14% · P3 Updated Nov 02, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Unknown	MapPress	`< 2.97.15`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

MapPress Maps for WordPress < 2.97.15 - Unauthenticated Email Address Disclosure

Source: CVE Program / CVE List V5

Vulnerability Description

The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Unknown	MapPress	0 ~ 2.97.15	-

II. Public POCs for CVE-2026-118168

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118168

请登录查看更多情报信息。

Other References for CVE-2026-118168 (1)

https://wpscan.com/vulnerability/ce9f0060-1054-41ca-9543-1508547aab27/ exploit vdb-entry technical-description

https://www.cve.org/CVERecord?id=CVE-2026-118168

Same Patch Batch · Unknown · 2026-11-01 · 5 CVEs total

CVE-2026-113482		Media Library Assistant < 3.44 - Contributor+ Stored XSS via mla_item_parameter Shortcode
CVE-2026-113481		Media Library Assistant < 3.44 - Subscriber+ Missing Authorization via mla-fill-compat-fie
CVE-2026-107343		Kali Forms < 2.4.30 - Subscriber+ Email Sending and Sender Spoofing
CVE-2026-107342		Kali Forms < 2.4.30 - Subscriber+ User Email Address Disclosure

IV. Related Vulnerabilities

Same vendor: Unknown