Unauthorized Data Exposure in WP Go Maps WordPress Plugin
CVE-2026-8385
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 15 June 2026
Badges
What is CVE-2026-8385?
The WP Go Maps plugin for WordPress prior to version 10.0.10 is susceptible to a security flaw that fails to properly enforce a marker approval filter in its admin-ajax fallback. This oversight enables unauthorized individuals to access sensitive marker data, which has not been vetted for public display by the site administrator. As a result, they can retrieve sensitive information including marker titles, categories, addresses, and descriptions. Website owners should take immediate action to update their plugins to mitigate potential data exposure.
Affected Version(s)
WP Go Maps 0 < 10.0.10
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.