{
 "id": "WPSEC-2026-2383",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2383/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2383/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2383/index.md",
 "title": "WP Map Block <= 3.1.0 - Authenticated (Author+) Sensitive Information Exposure via Map Post Type Data Sources",
 "description": "The WP Map Block plugin for WordPress is vulnerable to Sensitive Information Exposure via post type and listing data sources in all versions up to, and including, 3.1.0. This is because data sources accepted any registered post type, including non-public ones, and did not exclude password-protected posts. The public map search REST endpoint also resolved these sources without applying the plugin's feature gating. This makes it possible for authenticated attackers, with author-level access and above, to save a map that pulls titles, excerpts or content snippets, and links from non-public post types or password-protected posts, and then read them, or let anyone read them, through the public map search endpoint.",
 "plugin": {
  "slug": "wp-map-block",
  "name": "WP Map Block",
  "full_name": "WP Map Block – Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & Filters",
  "wordpress_org": "https://wordpress.org/plugins/wp-map-block/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-map-block/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-map-block"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.0.0",
    "from_inclusive": true,
    "to": "3.2.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.0.0 before 3.2.0"
  ]
 },
 "introduced_in": "3.0.0",
 "fixed_in": "3.2.0",
 "remediation": "Update to 3.2.0 or later.",
 "fix_released": "2026-11-02T14:01:28+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:22:19.435714+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2383/",
  "https://plugins.svn.wordpress.org/wp-map-block/tags/3.2.0/",
  "https://wordpress.org/plugins/wp-map-block/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-map-block",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-03"
 }
}