CVE

CVE-2026-8386

5.3

CVSSmedium

Exploitable remotely over the internet · no authentication required.

Description

The WP Go Maps WordPress plugin before 10.0.10 does not perform any approval-state filtering on its public single-marker REST endpoint, allowing unauthenticated users to retrieve marker records that an administrator has not yet approved for public display, including any PII placed in the address and description fields and the marker's geographic coordinates.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

wp go maps

Updated Nov 10, 2026View on NVD →

S4E scanner

mediumProduct Based Web Vulnerabilities~10 seconds

WP Go Maps < 10.0.10 - Unauthenticated Marker Information Disclosure

WP Go Maps WordPress plugin References: https://wpscan.com/vulnerability/fa7f5cb0-abe2-4079-9290-e0e4dc89f27f/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8386 Remediation: Upgrade to version 10.0.10 or later.

Used 20 times · 10 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: wp go maps

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →