CVE-2026-118168 — Vulnerability intelligence

—

Published: 2026-11-01T05:18:57.360

CVSS

Not available

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs.

Sources

• CVE-2026-118168
• Original advisory