Vulnerabilities / MapSVG – Vector maps, Image maps, Google Maps / WPSEC-2026-1158
MapSVG – Vector maps, Image maps, Google Maps <= 8.16.1 - Unauthenticated Sensitive Information Exposure via Collection REST Routes
High 7.5
CWE-200Fixed in 8.16.2
- ID
- WPSEC-2026-1158
- Plugin
- MapSVG – Vector maps, Image maps, Google Maps (mapsvg-lite-interactive-vector-maps)
- Affected
- all versions before 8.16.2
- Remediation
- Update to 8.16.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-16
- Attack surface
- MapSVG – Vector maps, Image maps, Google Maps on WPSec AttackSurface
- Fix released
- Published
Description
The MapSVG plugin for WordPress is vulnerable to Sensitive Information Exposure via the /mapsvg/v1/collection/{name} REST routes and their legacy /objects/ and /regions/ aliases in all versions up to, and including, 8.16.1. This is because the GET endpoints are publicly accessible and accept the names of internal repositories such as token, log and import_settings. This makes it possible for unauthenticated attackers to read the contents of the plugin's internal tables, including Google Sheets sync secrets, import settings, token hashes and logs.
References
- https://wpsec.com/vuln/WPSEC-2026-1158/
- https://plugins.svn.wordpress.org/mapsvg-lite-interactive-vector-maps/tags/8.16.2/
- https://wordpress.org/plugins/mapsvg-lite-interactive-vector-maps/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS