WordPress MapPress Maps <= 2.96.6 - Unauthenticated IDOR
CVE-2026-8839
Verified
Description
MapPress Maps for WordPress <= 2.96.6 contains an authorization bypass caused by missing ownership verification in REST API routes, letting unauthenticated attackers read any map data and authenticated contributors modify any map, exploit requires crafted API requests
Severity
Medium
CVSS Score
5.3
Exploit Probability
1%
Published Date
June 10, 2026
Template Author
0x_akoko
CVE-2026-8839.yaml
5.3Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVE ID:
cve-2026-8839
CWE ID:
cwe-639
Remediation Steps
Update to the latest version beyond 2.96.6.