Description
The MapPress Maps for WordPress plugin before 2.88.16 is affected by an IDOR as it does not ensure that posts to be retrieve via an AJAX action is a public map, allowing unauthenticated users to read arbitrary private and draft posts.
Published: 2024-02-12
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-16216 The MapPress Maps for WordPress plugin before 2.88.16 is affected by an IDOR as it does not ensure that posts to be retrieve via an AJAX action is a public map, allowing unauthenticated users to read arbitrary private and draft posts.
History

Wed, 07 May 2025 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 04 Oct 2024 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Mappresspro
Mappresspro mappress Maps For Wordpress
Weaknesses CWE-639
CPEs cpe:2.3:a:mappresspro:mappress_maps_for_wordpress:*:*:*:*:*:wordpress:*:*
Vendors & Products Mappresspro
Mappresspro mappress Maps For Wordpress
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Fri, 30 Aug 2024 13:00:00 +0000

Type Values Removed Values Added
Description The MapPress Maps for WordPress plugin before 2.88.16 does not ensure that posts to be retrieve via an AJAX action is a public map, allowing unauthenticated users to read arbitrary private and draft posts. The MapPress Maps for WordPress plugin before 2.88.16 is affected by an IDOR as it does not ensure that posts to be retrieve via an AJAX action is a public map, allowing unauthenticated users to read arbitrary private and draft posts.

Subscriptions

Mappresspro Mappress Maps For Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2025-05-07T20:53:05.377Z

Reserved: 2024-01-11T11:58:50.352Z

Link: CVE-2024-0421

cve-icon Vulnrichment

Updated: 2024-08-01T18:04:49.663Z

cve-icon NVD

Status : Modified

Published: 2024-02-12T16:15:08.620

Modified: 2025-05-07T21:16:00.960

Link: CVE-2024-0421

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses