CVE-2026-118168

CVE-2026-118168CVE-2026-118168

Description

The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs.

Scoring

CVSS 5.3 ()
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Last modified2026-11-01
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.