{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-118168","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","state":"PUBLISHED","assignerShortName":"WPScan","dateReserved":"2026-10-27T17:51:31.479Z","datePublished":"2026-11-01T06:00:23.081Z","dateUpdated":"2026-11-01T06:00:23.081Z"},"containers":{"cna":{"providerMetadata":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-11-01T06:00:23.081Z"},"title":"MapPress Maps for WordPress < 2.97.15 - Unauthenticated Email Address Disclosure","problemTypes":[{"descriptions":[{"description":"CWE-200 Information Exposure","lang":"en","type":"CWE"}]}],"affected":[{"vendor":"Unknown","product":"MapPress","versions":[{"status":"affected","versionType":"semver","version":"0","lessThan":"2.97.15"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"The MapPress  WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs."}],"references":[{"url":"https://wpscan.com/vulnerability/ce9f0060-1054-41ca-9543-1508547aab27/","tags":["exploit","vdb-entry","technical-description"]}],"credits":[{"lang":"en","value":"vuxvinh","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}}}}