EUVD-2026-36698
GHSA-7gcf-rrgh-pw4q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible REST endpoint requires no authentication or interaction; impact is low confidentiality only, no integrity or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
The WP Go Maps WordPress plugin before 10.0.10 does not perform any approval-state filtering on its public single-marker REST endpoint, allowing unauthenticated users to retrieve marker records that an administrator has not yet approved for public display, including any PII placed in the address and description fields and the marker's geographic coordinates.
AnalysisAI
WP Go Maps WordPress plugin before 10.0.10 exposes unapproved marker records - including PII in address and description fields and geographic coordinates - to unauthenticated users via an unguarded public REST API endpoint. The single-marker endpoint omits approval-state filtering entirely, meaning any data an administrator has staged but not yet approved is publicly readable without any credentials. A publicly available proof-of-concept exists per WPScan, and SSVC confirms the flaw is automatable, though EPSS at 0.14% (4th percentile) indicates no widespread exploitation at time of analysis.
Technical ContextAI
WP Go Maps is a WordPress mapping plugin that stores user-submitted or admin-created map markers in the database, including sensitive fields such as street address, description text, and GPS coordinates. WordPress exposes plugin-registered REST API endpoints under /wp-json/; this plugin registers a public single-marker endpoint that serves marker data without checking the marker's approval state - a field presumably set by administrators to control which markers are visible to the public. The root cause is a missing server-side authorization/filtering check (access control failure) on the read path of this endpoint. CPE data identifies the affected software as cpe:2.3:a:unknown:wp_go_maps:*:*:*:*:*:*:*:* covering all versions below 10.0.10. No CWE was assigned by the reporter, but this maps conceptually to CWE-284 (Improper Access Control) or CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).
RemediationAI
Update WP Go Maps to version 10.0.10 or later, which is confirmed as the patched release per the vendor advisory referenced by WPScan at https://wpscan.com/vulnerability/fa7f5cb0-abe2-4079-9290-e0e4dc89f27f/ and NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-8386. Until patching is possible, administrators should audit all pending/unapproved markers and remove or redact any PII from address and description fields, since that data is currently readable by anyone. As a compensating control, site operators could use a Web Application Firewall rule to block or rate-limit unauthenticated requests to the plugin's marker REST endpoint path (typically under /wp-json/), though this may break legitimate map functionality for public users. The most reliable immediate mitigation remains applying the 10.0.10 update.
More in Wp Go Maps
View allThe WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ma
In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize
The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.28 does not properly protect most of its REST API r
The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATH_INFO. Rated medium severi
The WP Google Maps WordPress plugin before 8.1.12 did not sanitise, validate of escape the Map Name when output in the M
The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity
Unauthenticated information disclosure in WP Go Maps WordPress plugin before 10.0.10 allows any visitor to retrieve map
Multiple cross-site scripting (XSS) vulnerabilities in the WP Google Maps plugin before 6.0.27 for WordPress allow remot
SQL injection in WP Go Maps WordPress plugin (all versions before 10.1.04) allows unauthenticated network attackers to r
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom JS
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today