WP Go Maps CVE-2026-8386

No special conditions are required for exploitation - the vulnerable REST endpoint is publicly accessible over the network with no authentication, no session token, and no user interaction required, consistent with the CVSS vector PR:N/UI:N/AV:N/AC:L. The only limiting factor is that the information disclosure is scoped to markers in an 'unapproved' state; approved markers are presumably already public by design, so the marginal harm depends on whether the specific site stores sensitive PII in draft markers. Sites that never use the approval workflow or store no sensitive data in unapproved markers face negligible real-world impact despite the unrestricted access vector.

The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a low-complexity, unauthenticated network attack with limited confidentiality impact and no integrity or availability exposure. This vector is consistent with the description: exploitation requires no authentication, no user interaction, and no special attack complexity - any internet-connected attacker can query the REST endpoint. However, EPSS at 0.14% (4th percentile) indicates very low observed exploitation probability relative to the broader CVE population, and the vulnerability is not listed in CISA KEV. A public POC exists per WPScan references, and SSVC classifies it as automatable with partial technical impact, meaning mass enumeration of unapproved markers across many WordPress sites is plausible with low effort. Real-world risk is therefore moderate for sites storing sensitive PII in unapproved markers, but limited in scope - the confidentiality breach is restricted to draft/unapproved marker data only, not the full dataset or administrative credentials.

An attacker scripted to enumerate WordPress sites running WP Go Maps sends unauthenticated GET requests to the plugin's public single-marker REST endpoint, iterating over marker IDs. For each unapproved marker returned, the attacker harvests PII such as home addresses, personal descriptions, and GPS coordinates that the site administrator had not yet approved for public display. A public POC is available via WPScan, lowering the bar for exploitation.