{"id":"CVE-2026-118168","state":"PUBLISHED","title":"MapPress Maps for WordPress < 2.97.15 - Unauthenticated Email Address Disclosure","description":"The MapPress  WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs.","publishedAt":"2026-11-01T06:00:23.081Z","updatedAt":"2026-11-01T06:00:23.081Z","severity":null,"assigner":"WPScan","products":["Unknown MapPress"],"affected":[{"vendor":"Unknown","product":"MapPress","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.97.15","versionType":"semver"}]}],"references":["https://wpscan.com/vulnerability/ce9f0060-1054-41ca-9543-1508547aab27/"],"weaknesses":[],"ingestedAt":"2026-11-01T06:04:06.026Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/118xxx/CVE-2026-118168.json","commit":"18d8b38848bf014dc50886d799aa620431d1af0f","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-118168","state":"PUBLISHED","datePublished":"2026-11-01T06:00:23.081Z","dateUpdated":"2026-11-01T06:00:23.081Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2026-10-27T17:51:31.479Z"},"containers":{"cna":{"title":"MapPress Maps for WordPress < 2.97.15 - Unauthenticated Email Address Disclosure","descriptions":[{"lang":"en","value":"The MapPress  WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs."}],"affected":[{"vendor":"Unknown","product":"MapPress","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.97.15","versionType":"semver"}]}],"references":[{"url":"https://wpscan.com/vulnerability/ce9f0060-1054-41ca-9543-1508547aab27/","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-200 Information Exposure","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2026-11-01T06:00:23.081Z"},"credits":[{"lang":"en","value":"vuxvinh","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}}}}}