The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated…
The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Product
- MapPress
- Exposure class
- Web platform
- NVD status
- Received
Why it ranks 20 (Routine)
- Product class: web platform
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.