Description
The WP Go Maps WordPress plugin before 10.0.10 does not perform any approval-state filtering on its public single-marker REST endpoint, allowing unauthenticated users to retrieve marker records that an administrator has not yet approved for public display, including any PII placed in the address and description fields and the marker's geographic coordinates.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WP Go Maps | < 10.0.10 | 10.0.10 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WP Go Maps < 10.0.10 - Unauthenticated Marker Information Disclosure http/cves/2026/CVE-2026-8386.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://wpscan.com/vulnerability/fa7f5cb0-abe2-4079-9290-e0e4dc89f27f/ exploit vdb-entry technical-description