CVE-2026-14839: Mapster WP Maps Information Disclosure

CVE-2026-14839 Overview

CVE-2026-14839 affects the Mapster WP Maps WordPress plugin in versions prior to 1.24.0. The plugin exposes a public REST endpoint that omits authorization and post-status checks. Unauthenticated attackers can query the endpoint to retrieve the title and full content of any post on the site. This includes draft, pending, private, and trashed posts that site owners intended to keep hidden.

The issue is categorized under [CWE-200] Information Exposure. It carries a CVSS 3.1 base score of 7.5 with a network-based attack vector and no privileges required.

Critical Impact
Unauthenticated remote users can enumerate and read the full content of unpublished WordPress posts, including drafts, pending items, private posts, and trashed material.

Affected Products

Mapster WP Maps WordPress plugin versions prior to 1.24.0
WordPress sites with the vulnerable plugin activated
Any deployment exposing the plugin's REST route to unauthenticated network traffic

Discovery Timeline

2026-08-01 - CVE-2026-14839 published to the National Vulnerability Database
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-14839

Vulnerability Analysis

The Mapster WP Maps plugin registers a public REST API endpoint intended to feed post content into map-related components. The endpoint accepts a post identifier from unauthenticated callers and returns the associated post's title and content. The handler does not verify caller authorization or evaluate the post's publication status before returning data.

WordPress core normally restricts REST responses to publish status posts for unauthenticated requests. Custom endpoints inherit no such protection unless developers implement it explicitly. In this plugin, the callback function retrieves post objects directly by ID and serializes their fields into the response body.

Because the endpoint returns raw post fields, sensitive material intended for internal review, embargoed announcements, and scheduled posts is disclosed. Attackers can iterate post IDs sequentially to enumerate the entire post table on a target site.

Root Cause

The root cause is missing authorization logic on a REST route registered by the plugin. The permission_callback argument either returns true unconditionally or is set to __return_true, granting anyone access. The handler also fails to filter by post_status, so all posts are eligible for retrieval regardless of visibility.

Attack Vector

An attacker sends unauthenticated HTTP GET requests to the vulnerable REST endpoint exposed by the Mapster WP Maps plugin. By supplying arbitrary post IDs as parameters, the attacker receives the title and full body of each requested post. Iterating IDs from 1 upward enables full content enumeration.

The vulnerability manifests in the plugin's REST route registration and its post retrieval callback. Consult the WPScan Vulnerability Report for endpoint-specific technical details.

Detection Methods for CVE-2026-14839

Indicators of Compromise

Unauthenticated HTTP GET requests to /wp-json/ routes registered by the Mapster WP Maps plugin
Sequential enumeration patterns against a single REST endpoint from one source address
Response payloads containing content of posts with non-publish statuses returned to anonymous clients
Elevated volume of REST API traffic from residential or hosting-provider IP ranges targeting the plugin route

Detection Strategies

Enable WordPress REST API access logging and search for anonymous callers hitting the plugin's route with varying id parameters
Compare returned post identifiers against the database to flag responses that include drafts, pending, private, or trashed posts
Alert on high request rates to a single REST endpoint originating from unauthenticated sessions

Monitoring Recommendations

Ingest web server and WordPress access logs into a centralized analytics platform for retrospective hunting
Track the installed version of Mapster WP Maps across the estate and alert when instances are below 1.24.0
Monitor egress of post content bodies in HTTP responses to unauthenticated clients as a signal of information exposure

How to Mitigate CVE-2026-14839

Immediate Actions Required

Upgrade the Mapster WP Maps plugin to version 1.24.0 or later on every affected WordPress site
Audit posts marked as draft, pending, private, or trashed for sensitivity and treat any embargoed content as potentially disclosed
Review web server access logs for prior anonymous requests to the plugin's REST route and quantify exposure

Patch Information

The vendor addressed the issue in Mapster WP Maps 1.24.0 by adding authorization and post-status validation to the affected REST endpoint. Refer to the WPScan Vulnerability Report for the fixed version reference.

Workarounds

Deactivate the Mapster WP Maps plugin until the site can be updated to 1.24.0
Restrict access to the plugin's REST route at the web server or WAF layer, denying unauthenticated requests
Remove sensitive content from draft and private posts on affected sites until the patch is applied

bash

# Example nginx rule to block anonymous access to the plugin REST namespace
location ~* /wp-json/mapster-wp-maps/ {
    if ($http_cookie !~* "wordpress_logged_in") {
        return 403;
    }
}