WP Go Maps CVE-2026-8385

Exploitation requires the target site to have WP Go Maps installed at a version earlier than 10.0.10 AND to have at least one marker in an unapproved or pending state in the database - the marker approval workflow must be in active use for any sensitive data to be exposed. No authentication, user interaction, special network position, or non-default WordPress configuration is required; admin-ajax.php is reachable by unauthenticated HTTP clients in all standard WordPress deployments. Exploitation is strictly limited to read access on unapproved marker metadata (title, category, address, description); it does not provide write access, code execution, session hijacking, or access to credentials. Sites where all submitted markers are immediately published without a moderation step, or where no user-submitted markers exist, have no meaningful exposure from this vulnerability.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N accurately reflects a low-complexity, unauthenticated read of limited data, producing a moderate base score of 5.3. EPSS at 0.14% (3rd percentile) is very low, and SSVC rates exploitation as 'none' despite marking the vulnerability as automatable with partial technical impact - a combination suggesting the exploit is known but mass exploitation is not occurring. Notably, a public exploit is confirmed via WPScan, yet neither CISA KEV nor EPSS signal active targeting, implying the exploit exists but threat actors have not adopted it at scale. The confidentiality impact is bounded by context: sites that use the marker approval workflow for moderated user-submitted locations face real exposure of draft or rejected data, while sites where all markers are pre-approved have no meaningful exposure. This is a genuine medium-priority issue for operators using the approval feature, but not an emergency patch scenario for most deployments.

An unauthenticated attacker sends a crafted HTTP request to the target WordPress site's admin-ajax.php endpoint invoking the WP Go Maps datatables action, omitting or bypassing the approval-status parameter that the plugin fails to enforce server-side. The server returns a paginated JSON response containing all pending and rejected marker records - including physical addresses, titles, categories, and descriptions - that the site owner had not yet approved for public display. A public exploit is confirmed via WPScan, meaning this requires minimal technical skill to reproduce against any unpatched site using the marker approval feature.