CVE-2026-8386: WP Go Maps REST API Leaks Unapproved Marker Data

Technical summary

The WP Go Maps plugin contains an access control bypass in its REST API single-marker endpoint. The endpoint fails to validate the approval state of marker records before returning them in response to unauthenticated requests. As a result, markers not yet approved for public display are accessible via the public REST API, exposing their full data payload including geographic coordinates, address fields, and description content that may contain personally identifiable information (PII).

Business impact

Organizations using WP Go Maps to manage location data on their WordPress sites face unintended disclosure of sensitive information before content is formally approved. If markers contain customer addresses, business locations, or personally identifiable details, this leakage could violate privacy commitments, regulatory requirements, or customer trust. The exposure is passive—no data is modified or deleted—but confidentiality is compromised during the approval workflow window.

Affected systems

The WP Go Maps WordPress plugin is affected in all versions before 10.0.10. The vulnerability exists in the public single-marker REST endpoint and requires no authentication to exploit. Any WordPress installation running an older version of this plugin is at risk if it uses the marker functionality.

Exploitability

Exploitation requires no special skills or authentication. An attacker with only network access can query the REST API endpoint to enumerate and retrieve marker records, regardless of approval status. Discovery of the endpoint is straightforward for anyone familiar with WordPress REST API conventions. The barrier to exploitation is extremely low, though the attacker must know or guess the marker identifiers to retrieve specific records.

Remediation

Update the WP Go Maps plugin to version 10.0.10 or later. The patch adds approval-state filtering to the public REST endpoint, ensuring only administrator-approved markers are returned in unauthenticated API responses. Organizations should verify this update is available from their plugin repository and apply it immediately to production sites.

Patch guidance

Navigate to WordPress Dashboard > Plugins > Installed Plugins, locate WP Go Maps, and check for available updates. Apply the update to version 10.0.10 or above. Verify the update completed successfully and test the map functionality on your site. Organizations with managed WordPress hosting may request automatic updates or schedule updates during a maintenance window. Review plugin changelogs to confirm the approval-filtering fix is included.

Detection guidance

Check plugin versions across all WordPress installations to identify sites running WP Go Maps before 10.0.10. Review access logs for REST API requests to endpoints matching the pattern /wp-json/…/markers or similar, particularly any requests that return marker data with unapproved status flags. Monitor for unusual API query patterns or enumeration attempts targeting marker endpoints. Web application firewalls can be configured to restrict unauthenticated access to sensitive REST endpoints if updates cannot be applied immediately.

Why prioritize this

Although the CVSS score is medium (5.3), this vulnerability should be addressed promptly because it leaks PII and geographic coordinates without requiring authentication or user interaction. The approval workflow is a key control for managing content visibility; its bypass undermines that control. Organizations handling customer locations, addresses, or other sensitive marker data should prioritize this patch. The ease of exploitation and low barrier to discovery increase practical risk despite the moderate severity rating.

Risk score, explained

The CVSS v3.1 score of 5.3 (Medium) reflects low confidentiality impact over a network, no authentication required, and no complexity. The score does not account for the sensitivity of geographic and personal data often stored in location markers, nor the workflow-control implications of the bypass. In practice, organizations managing sensitive location data should weight this higher than the base CVSS suggests, particularly in regulated industries handling PII.

Frequently asked questions