CVE-2024-0421 MapPress Maps for WordPress < 2.88.16 - Unauthenticated Arbitrary Private/Draft Post Disclosure

The MapPress Maps for WordPress plugin before 2.88.16 is affected by an IDOR as it does not ensure that posts to be retrieve via an AJAX action is a public map, allowing unauthenticated users to read arbitrary private and draft posts...

CVE-2024-0421

The CVE-2024-0421 entry concerns the WordPress MapPress Maps plugin prior to 2.88.16, where an IDOR allows unauthenticated users to read private and draft posts via an AJAX action that should only expose public maps. Multiple connected sources confirm the flaw and its public-facing impact, includ...