title: MapPress Maps for WordPress < 2.88.16 - Unauthenticated Arbitrary Private/Draft Post Disclosure
description: The MapPress Maps for WordPress plugin before 2.88.16 does not ensure that posts to be retrieve via an AJAX action is a public map, allowing unauthenticated users to read arbitrary private and draft posts.
problem types: CWE-862 Missing Authorization
affected:
{
vendor: Unknown
product: MapPress Maps for WordPress
versions:
status: affected, versionType: semver, version: 0, lessThan: 2.88.16
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}