# MapSVG – Vector maps, Image maps, Google Maps <= 8.16.1 - Unauthenticated Sensitive Information Exposure via Collection REST Routes

- **ID:** WPSEC-2026-1158
- **Plugin:** MapSVG – Vector maps, Image maps, Google Maps (`mapsvg-lite-interactive-vector-maps`), https://wordpress.org/plugins/mapsvg-lite-interactive-vector-maps/
- **Affected versions:** all versions before 8.16.2
- **Fixed in:** 8.16.2 (Update to 8.16.2 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-17)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/mapsvg-lite-interactive-vector-maps
- **Fix released:** 2026-10-16
- **Published:** 2026-10-17
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1158/

## Description

The MapSVG plugin for WordPress is vulnerable to Sensitive Information Exposure via the /mapsvg/v1/collection/{name} REST routes and their legacy /objects/ and /regions/ aliases in all versions up to, and including, 8.16.1. This is because the GET endpoints are publicly accessible and accept the names of internal repositories such as token, log and import_settings. This makes it possible for unauthenticated attackers to read the contents of the plugin's internal tables, including Google Sheets sync secrets, import settings, token hashes and logs.

## References

- https://wpsec.com/vuln/WPSEC-2026-1158/
- https://plugins.svn.wordpress.org/mapsvg-lite-interactive-vector-maps/tags/8.16.2/
- https://wordpress.org/plugins/mapsvg-lite-interactive-vector-maps/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1158/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.