Description
The WP Go Maps WordPress plugin before 10.0.10 does not properly enforce the marker approval filter on the admin-ajax fallback for its datatables route, allowing unauthenticated visitors to retrieve marker records that the site owner has not approved for public display, including their title, category, address and description fields.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WP Go Maps | < 10.0.10 | 10.0.10 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WordPress WP Go Maps < 10.0.10 - Unauthenticated Marker Data Disclosure http/cves/2026/CVE-2026-8385.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://wpscan.com/vulnerability/984cad38-6d01-4956-8bf1-29585258780b/ exploit vdb-entry technical-description