EUVD-2026-36697
GHSA-f9fr-2hr3-67mf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible admin-ajax endpoint requires no authentication; only partial confidentiality impact as only unapproved marker metadata is leaked, with no integrity or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
The WP Go Maps WordPress plugin before 10.0.10 does not properly enforce the marker approval filter on the admin-ajax fallback for its datatables route, allowing unauthenticated visitors to retrieve marker records that the site owner has not approved for public display, including their title, category, address and description fields.
AnalysisAI
Unauthenticated information disclosure in WP Go Maps WordPress plugin before 10.0.10 allows any visitor to retrieve map marker records that site administrators have deliberately withheld from public display. The plugin's datatables route, when accessed via the admin-ajax.php fallback, fails to enforce the marker approval filter, exposing pending or rejected markers including their title, category, address, and description fields. A publicly available exploit exists per WPScan, but EPSS at 0.14% (3rd percentile) and SSVC exploitation rating of 'none' indicate this is not being actively leveraged at scale despite ease of execution.
Technical ContextAI
WP Go Maps is a WordPress plugin for embedding interactive maps with user-submittable custom markers. WordPress's admin-ajax.php is a standard dispatcher for AJAX requests that is reachable by unauthenticated users by default; plugins must manually enforce access controls within their registered handlers. The vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) arises because the datatables endpoint used to paginate marker records omits the approval-status filter when routed through the admin-ajax fallback, creating a gap between the intended access control policy and its enforcement. The affected CPE is cpe:2.3:a:unknown:wp_go_maps:*:*:*:*:*:*:*:*, covering all versions from 0 up to 10.0.10. No memory corruption, injection, or authentication bypass is involved - this is a pure authorization logic failure at the API layer.
RemediationAI
Upgrade WP Go Maps to version 10.0.10 or later, which is confirmed as the patched release per the EUVD affected-version range; the update is available through the WordPress plugin dashboard or the WordPress.org plugin repository. If immediate upgrade is not feasible, the most targeted compensating control is to disable the marker approval queue entirely so that no unapproved markers exist in the database - this eliminates the exposed dataset but prevents use of the moderated submission workflow. Restricting unauthenticated access to admin-ajax.php at the web server level is technically feasible but carries a high risk of breaking other WordPress core and plugin functionality and should only be attempted in isolated environments after thorough testing. Advisory references: https://wpscan.com/vulnerability/984cad38-6d01-4956-8bf1-29585258780b/ and https://nvd.nist.gov/vuln/detail/CVE-2026-8385.
More in Wp Go Maps
View allThe WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ma
In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize
The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.28 does not properly protect most of its REST API r
The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATH_INFO. Rated medium severi
The WP Google Maps WordPress plugin before 8.1.12 did not sanitise, validate of escape the Map Name when output in the M
The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity
WP Go Maps WordPress plugin before 10.0.10 exposes unapproved marker records - including PII in address and description
Multiple cross-site scripting (XSS) vulnerabilities in the WP Google Maps plugin before 6.0.27 for WordPress allow remot
SQL injection in WP Go Maps WordPress plugin (all versions before 10.1.04) allows unauthenticated network attackers to r
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom JS
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today