CVE-2026-8386
published 2026-06-15CVE-2026-8386: The WP Go Maps WordPress plugin before 10.0.10 does not perform any approval-state filtering on its public single-marker REST endpoint, allowing…
PriorityP340medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EXPLOIT
EPSS
0.49%
38.9th percentile
The WP Go Maps WordPress plugin before 10.0.10 does not perform any approval-state filtering on its public single-marker REST endpoint, allowing unauthenticated users to retrieve marker records that an administrator has not yet approved for public display, including any PII placed in the address and description fields and the marker's geographic coordinates.
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
The WP Go Maps WordPress plugin before 10.0.10 does not perform any approval-state filtering on its public single-marker REST endpoint, allowing unauthenticated users to retrieve marker records that
ghsa_unreviewed·2026-06-15
CVE-2026-8386 [MEDIUM] The WP Go Maps WordPress plugin before 10.0.10 does not perform any approval-state filtering on its public single-marker REST endpoint, allowing unauthenticated users to retrieve marker records that
The WP Go Maps WordPress plugin before 10.0.10 does not perform any approval-state filtering on its public single-marker REST endpoint, allowing unauthenticated users to retrieve marker records that an administrator has not yet approved for public display, including any PII placed in the address and description fields and the marker's geographic coordinates.
VulDB
WP Go Maps Plugin up to 10.0.9 on WordPress REST Endpoint address/description information disclosure
vuldb·2026-06-15·CVSS 5.3
CVE-2026-8386 [MEDIUM] WP Go Maps Plugin up to 10.0.9 on WordPress REST Endpoint address/description information disclosure
A vulnerability classified as problematic was found in WP Go Maps Plugin up to 10.0.9 on WordPress. This impacts an unknown function of the component REST Endpoint. Such manipulation of the argument address/description leads to information disclosure.
This vulnerability is traded as CVE-2026-8386. The attack may be launched remotely. There is no exploit available.
Upgrading the affected component is advised.
No detection rules found.
Nuclei
WP Go Maps < 10.0.10 - Unauthenticated Marker Information Disclosure
nuclei·CVSS 5.3
CVE-2026-8386 [MEDIUM] WP Go Maps < 10.0.10 - Unauthenticated Marker Information Disclosure
WP Go Maps =1.0.0", "<=10.0.9")'
condition: and
internal: true
extractors:
- type: regex
name: lsversion
internal: true
group: 1
regex:
- 'Stable tag: ([\d.]+)'
- method: GET
path:
- "{{BaseURL}}/?rest_route=/wpgmza/v1/markers/1/"
- "{{BaseURL}}/?rest_route=/wpgmza/v1/markers/2/"
- "{{BaseURL}}/?rest_route=/wpgmza/v1/markers/3/"
matchers:
- type: dsl
dsl:
- 'status_code == 200'
- 'contains(content_type, "application/json")'
- 'contains_all(body, "approved", "lat", "lng", "map_id")'
condition: and
# digest: 4a0a00473045022100d631fbb38e1a5796f6ad7f0121a0854c0a8cd6d346c87f345b5c32d0d21c9d0802204a6bc1b57a73d80ed55b6091a859f8e812c953199a532560bdafa4be0e4e50d5:922c64590222798bb761d5b6d8e72950
No writeups or analysis indexed.
2026-06-15
Published