CVE-2026-8385

The WP Go Maps WordPress plugin before 10.0.10 does not properly enforce the marker approval filter on the admin-ajax fallback for its datatables route, allowing unauthenticated visitors to retrieve marker records that the site owner has not approved for public display, including their title, category, address and description fields.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://wpscan.com/vulnerability/984cad38-6d01-4956-8bf1-29585258780b/

Configurations

No configuration.

History

No history.

Information

Published : 2026-06-15 08:16

Updated : 2026-07-23 11:10

NVD link : CVE-2026-8385

Mitre link : CVE-2026-8385

CVE.ORG link : CVE-2026-8385

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2026-8385", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8385", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T12:37:06.859604Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "contact@wpscan.com", "affectedData": [{"vendor": "Unknown", "product": "WP Go Maps", "versions": [{"status": "affected", "version": "0", "lessThan": "10.0.10", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-15T08:16:21.013", "references": [{"url": "https://wpscan.com/vulnerability/984cad38-6d01-4956-8bf1-29585258780b/", "source": "contact@wpscan.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The WP Go Maps WordPress plugin before 10.0.10 does not properly enforce the marker approval filter on the admin-ajax fallback for its datatables route, allowing unauthenticated visitors to retrieve marker records that the site owner has not approved for public display, including their title, category, address and description fields."}, {"lang": "es", "value": "El plugin de WordPress WP Go Maps anterior a la versi\u00f3n 10.0.10 no aplica correctamente el filtro de aprobaci\u00f3n de marcadores en el fallback de admin-ajax para su ruta de datatables, permitiendo a visitantes no autenticados recuperar registros de marcadores que el propietario del sitio no ha aprobado para su visualizaci\u00f3n p\u00fablica, incluyendo sus campos de t\u00edtulo, categor\u00eda, direcci\u00f3n y descripci\u00f3n."}], "lastModified": "2026-07-23T11:10:00.120", "sourceIdentifier": "contact@wpscan.com"}