WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Marker ID
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
The WP Go Maps WordPress plugin before 10.0.10 does not perform any approval-state filtering on its public single-marker REST endpoint, allowing unauthenticated users to retrieve marker records that an administrator has not yet approved for public display, including any PII placed in the address and description fields and the marker's geographic coordinates.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | WP Go Maps | before 10.0.10 | 10.0.10 | Patch available | CNA |
- WP Go Maps VendorUnknown Affected before 10.0.10 Fixed in 10.0.10 Patch available CNA
Remediation
- Fix · CNA WP Go Maps (Unknown) Fixed in 10.0.10
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
WP Go Maps 10.0.10
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-07373 WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Datatables AJAX FallbackPriority LOW 31
Timeline
- 2026-10-02 Threatist record created from CVE-2026-8386
- 2026-10-03 Alias added: GHSA-7gcf-rrgh-pw4q
References
Sources
- CVE-2026-8386 · CVE Program
- CVE-2026-8386 · NVD
- FIRST EPSS
- GHSA-7gcf-rrgh-pw4q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences