CVE-2026-8839 Details

A vulnerability allowing authorization bypass has been identified in the MapPress Maps for WordPress plugin, affecting all versions up to and including 2.96.6. The issue arises from inadequate ownership verification in the REST API routes established by 'Mappress_Api::rest_api_init()'. Specifically, the GET '/wp-json/mapp/v1/maps/{mapid}' endpoint improperly uses 'permission_callback' => '__return_true', while the write endpoints (POST update, DELETE, PATCH mutate, POST clone, POST empty_trash) only verify the generic 'edit_posts' capability without ensuring that the requester owns the map in question. This oversight is not addressed at the model layer, allowing unauthorized access to sensitive map data, such as POI titles, addresses, coordinates, and body content. Unauthenticated attackers can exploit this by enumerating map IDs to access data from any map on the site. Additionally, authenticated attackers with Contributor-level access or higher can manipulate, delete, restore, or clone any map, regardless of its author.

Users are advised to update to MapPress Maps for WordPress version 2.97.1 or later, where this vulnerability has been addressed.