The MapPress Maps for WordPress plugin is vulnerable to an authorization bypass (CWE-639) in all versions up to 2.96.6. The REST API routes registered via Mappress_Api::rest_api_init() lack proper ownership checks. The GET endpoint /wp-json/mapp/v1/maps/{mapid} uses a permission callback that always returns true, allowing unauthenticated read access to any map's data. Write endpoints only verify the generic edit_posts capability without confirming map ownership. The underlying model methods operate on any caller-supplied map ID without ownership validation, enabling authenticated users with Contributor-level access or higher to modify, delete, clone, or trash any map regardless of author.

Unauthenticated attackers can access sensitive map data such as points of interest titles, addresses, coordinates, and body content by enumerating map IDs. Authenticated users with Contributor-level or higher privileges can perform unauthorized modifications, deletions, cloning, or trashing/restoring of any map on the site, bypassing intended ownership restrictions. This could lead to data exposure and unauthorized data manipulation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the REST API endpoints or disable the MapPress Maps plugin if possible. Limit user roles to trusted users only and monitor for unusual map modifications. Do not rely on the plugin's current ownership checks for map data protection.