{
 "id": "WPSEC-2026-1158",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1158/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1158/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1158/index.md",
 "title": "MapSVG – Vector maps, Image maps, Google Maps <= 8.16.1 - Unauthenticated Sensitive Information Exposure via Collection REST Routes",
 "description": "The MapSVG plugin for WordPress is vulnerable to Sensitive Information Exposure via the /mapsvg/v1/collection/{name} REST routes and their legacy /objects/ and /regions/ aliases in all versions up to, and including, 8.16.1. This is because the GET endpoints are publicly accessible and accept the names of internal repositories such as token, log and import_settings. This makes it possible for unauthenticated attackers to read the contents of the plugin's internal tables, including Google Sheets sync secrets, import settings, token hashes and logs.",
 "plugin": {
  "slug": "mapsvg-lite-interactive-vector-maps",
  "name": "MapSVG – Vector maps, Image maps, Google Maps",
  "full_name": "MapSVG – Vector maps, Image maps, Google Maps",
  "wordpress_org": "https://wordpress.org/plugins/mapsvg-lite-interactive-vector-maps/",
  "advisories_url": "https://wpsec.com/vuln/plugin/mapsvg-lite-interactive-vector-maps/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/mapsvg-lite-interactive-vector-maps"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "8.16.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 8.16.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "8.16.2",
 "remediation": "Update to 8.16.2 or later.",
 "fix_released": "2026-10-16T05:12:27+00:00",
 "published": "2026-10-17T05:42:11+00:00",
 "updated": "2026-10-16T09:50:39.472867+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1158/",
  "https://plugins.svn.wordpress.org/mapsvg-lite-interactive-vector-maps/tags/8.16.2/",
  "https://wordpress.org/plugins/mapsvg-lite-interactive-vector-maps/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/mapsvg-lite-interactive-vector-maps",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-17"
 }
}