CVE-2026-8386 json
WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Marker ID
published 2026-06-15 4 mo ago modified 2026-07-23 3 mo ago also EUVD-2026-36698
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 53%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
The WP Go Maps WordPress plugin before 10.0.10 does not perform any approval-state filtering on its public single-marker REST endpoint, allowing unauthenticated users to retrieve marker records that an administrator has not yet approved for public display, including any PII placed in the address and description fields and the marker's geographic coordinates.
Patch / fix
- Unknown WP Go Maps 10.0.10
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 4 mo ago
Exploit prediction
0.70% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template WP Go Maps < 10.0.10 - Unauthenticated Marker Information Disclosure nuclei detection template
- wpscan.com https://wpscan.com/vulnerability/fa7f5cb0-abe2-4079-9290-e0e4dc89f27f/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected products
- Unknown WP Go Maps
Classification
- Technology feeds
References
-
wpscan.com
/vulnerability/fa7f5cb0-abe2-4079-9290-e0e4dc89f27f/
exploit, vdb-entry, technical-description
Sources
- CVE List CVE-2026-8386
- NVD CVE-2026-8386
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.