Description
The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | MapPress | < 2.97.15 | 2.97.15 |
References
- https://wpscan.com/vulnerability/ce9f0060-1054-41ca-9543-1508547aab27/ exploit vdb-entry technical-description