WP Maps CVE-2026-28144

Exploitation requires a valid WordPress user account with at minimum subscriber-level privileges (confirmed by CVSS PR:L). The WP Maps plugin must be installed and active on the target WordPress site, and a Google Maps API key (or equivalent sensitive credential) must be configured within the plugin settings. No special network position is required - the vulnerable endpoint is accessible over the internet to any authenticated user. Exploitation is limited by the requirement for authentication; unauthenticated visitors cannot trigger the data leak. Sites that have disabled open user registration or restrict accounts to known employees have a significantly reduced attack surface.

The CVSS 3.1 base score of 4.3 (Medium) reflects a constrained but real-world risk profile: the attack vector is network (AV:N) with low complexity (AC:L) and no user interaction (UI:N), but requires low-privilege authentication (PR:L), limiting exposure to registered WordPress users. The confidentiality impact is partial (C:L), with no integrity or availability impact, consistent with a read-only data leak. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. No public POC has been identified at time of analysis. The realistic threat is an insider - a subscriber-level user or attacker who has compromised any WordPress account - extracting the Google Maps API key, which could then be abused for API quota theft or cost fraud against the site owner. The severity is moderate rather than critical, but on multi-tenant WordPress installations (agencies, shared hosting) the blast radius extends beyond the immediate site.

An attacker registers as a subscriber-level user on a WordPress site running WP Maps through 4.9.6, then sends an authenticated request to the plugin's AJAX or REST endpoint that returns map configuration data. The response contains the site's Google Maps API key embedded in the payload, which the attacker extracts and uses to make API calls billed to the victim site's Google account. No public exploit code has been identified at time of analysis, but the attack requires only standard HTTP tooling and a low-privilege account.