CVE-2026-8839 is an authorization bypass vulnerability in the MapPress Maps for WordPress plugin affecting all versions up to 2.96.6. The REST API routes registered via Mappress_Api::rest_api_init() lack proper ownership verification. The GET endpoint for retrieving maps uses a permission callback that always returns true, allowing unauthenticated access to map data. Write operations (POST update, DELETE, PATCH mutate, POST clone, POST empty_trash) only check for the generic edit_posts capability but do not verify if the requester owns the map resource. The underlying model methods operate on any caller-supplied map ID without ownership checks, enabling unauthorized read and write access to map data.

Unauthenticated attackers can access sensitive map information such as points of interest titles, addresses, coordinates, and content by enumerating map IDs. Authenticated users with Contributor-level permissions or higher can modify, delete, trash, restore, or clone any map regardless of ownership, potentially leading to unauthorized data manipulation. There is no indication of availability impact or privilege escalation beyond these capabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the REST API endpoints related to MapPress Maps or limit Contributor-level user permissions to trusted users only. Monitor for updates from the vendor or plugin maintainer to apply an official fix once released.