CVE-2026-65564: MapPress Maps Information Disclosure Flaw

CVE-2026-65564 Overview

CVE-2026-65564 is an unauthenticated sensitive data exposure vulnerability affecting the MapPress Maps for WordPress plugin in versions up to and including 2.97.6. The flaw is categorized under [CWE-497] (Exposure of Sensitive System Information to an Unauthorized Control Sphere) and allows remote attackers to retrieve information they should not have access to without providing credentials. The issue is reachable over the network with low attack complexity and requires no user interaction. Site operators running the affected plugin should treat any exposed data as potentially collected by third parties.

Critical Impact
Unauthenticated remote attackers can retrieve sensitive information from WordPress sites running MapPress Maps for WordPress <= 2.97.6 without any user interaction or credentials.

Affected Products

MapPress Maps for WordPress plugin versions <= 2.97.6
WordPress installations with the vulnerable plugin activated
Any web-accessible site exposing the affected plugin endpoints

Discovery Timeline

2026-07-27 - CVE-2026-65564 published to the National Vulnerability Database (NVD)
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-65564

Vulnerability Analysis

The vulnerability arises from the MapPress Maps for WordPress plugin exposing sensitive information through an endpoint that lacks proper access controls. Because the flaw is unauthenticated, an attacker only needs network access to a target WordPress site to trigger the disclosure. The CWE-497 classification indicates the plugin returns system-level or configuration information to callers that should not receive it.

The impact is limited to confidentiality. Integrity and availability of the affected WordPress site are not directly affected by this issue. However, exposed information can be used as reconnaissance to support follow-on attacks against the WordPress instance, its plugins, or the underlying host.

The EPSS probability for this CVE is currently low, indicating limited observed exploitation activity in the short term. Because the plugin is broadly deployed and the exploit path requires no authentication, defenders should not treat the low EPSS as a reason to delay patching.

Root Cause

The root cause is missing or insufficient authorization on a plugin endpoint that returns sensitive data. The endpoint fails to verify that the caller is authenticated or authorized before disclosing the response, which is the defining characteristic of [CWE-497].

Attack Vector

Exploitation occurs over the network against the WordPress site's public HTTP(S) interface. An attacker issues a crafted HTTP request to the affected plugin endpoint and receives sensitive information in the response body. No credentials, cookies, or user interaction are required.

No verified proof-of-concept code is publicly indexed for this CVE at the time of writing. Refer to the Patchstack Vulnerability Advisory for additional technical detail.

Detection Methods for CVE-2026-65564

Indicators of Compromise

Unauthenticated HTTP GET or POST requests to MapPress plugin endpoints under /wp-content/plugins/mappress-google-maps-for-wordpress/ or MapPress AJAX/REST routes
Anomalous response sizes from MapPress endpoints returning configuration or system-level fields
Repeated scanning of /wp-json/ or admin-ajax.php actions associated with MapPress from a single source

Detection Strategies

Inventory all WordPress sites and identify installations of MapPress Maps for WordPress at version 2.97.6 or earlier
Alert on unauthenticated requests to MapPress endpoints, especially from source IPs performing plugin enumeration
Correlate WordPress access logs with web application firewall (WAF) telemetry to detect probing patterns matching the disclosure request

Monitoring Recommendations

Ingest WordPress and reverse-proxy access logs into a centralized analytics platform for retention and query
Track outbound response payload sizes from MapPress routes to identify unexpected data returns
Monitor plugin version metadata across the estate and flag any host still running MapPress <= 2.97.6

How to Mitigate CVE-2026-65564

Immediate Actions Required

Identify all WordPress sites running MapPress Maps for WordPress and confirm the installed version
Update MapPress Maps for WordPress to a fixed release above 2.97.6 as published by the vendor
Review WordPress and web server logs for unauthenticated access to MapPress endpoints and treat any exposed data as disclosed

Patch Information

Refer to the Patchstack Vulnerability Advisory for the vendor-published fix and recommended target version. Apply the update through the WordPress plugin manager or by replacing the plugin files with the patched release.

Workarounds

Deactivate the MapPress Maps for WordPress plugin until it can be updated to a patched version
Restrict access to the affected plugin endpoints at the WAF or reverse proxy with rules denying unauthenticated requests
Rotate any credentials, API keys, or tokens that may have been exposed through the vulnerable endpoint

bash

# Configuration example: block unauthenticated access to MapPress endpoints at the reverse proxy
location ~* /wp-content/plugins/mappress-google-maps-for-wordpress/ {
    deny all;
    return 403;
}