CVE-2026-28144 Overview
CVE-2026-28144 is a sensitive data exposure vulnerability in the Flipper Code WP Maps plugin for WordPress. The plugin embeds sensitive information into data sent to clients, allowing authenticated users with low privileges to retrieve that data. The issue affects all versions of WP Maps up to and including 4.9.6. The vulnerability is categorized under CWE-201: Insertion of Sensitive Information Into Sent Data. Exploitation requires network access and low-level authentication but no user interaction.
Critical Impact
Authenticated attackers can retrieve embedded sensitive data from the WP Maps plugin, potentially exposing configuration values or internal information intended to remain server-side.
Affected Products
- Flipper Code WP Maps plugin for WordPress
- All versions from initial release through 4.9.6
- WordPress installations using the wp-google-map-plugin package
Discovery Timeline
- 2026-07-31 - CVE-2026-28144 published to NVD
- 2026-07-31 - Last updated in NVD database
Technical Details for CVE-2026-28144
Vulnerability Analysis
The WP Maps plugin transmits response data that contains sensitive information not intended for disclosure to the requesting client. Under CWE-201, this class of flaw occurs when server-side logic includes internal values, configuration data, or metadata in outbound responses without filtering. An authenticated user with minimal privileges can trigger requests that return this embedded data.
The scope of exposure is limited to confidentiality. The vulnerability does not permit modification of data or disruption of service. However, disclosed information may support follow-on attacks, such as reconnaissance for privilege escalation or lateral movement within a WordPress environment.
The EPSS score for this issue is 0.176%, placing it in the 7.315 percentile of vulnerabilities ranked by likelihood of exploitation.
Root Cause
The root cause is improper filtering of server-side data before inclusion in HTTP responses generated by the WP Maps plugin. The plugin does not distinguish between data intended for the client and data intended to remain internal, so both are transmitted together. Refer to the Patchstack Vulnerability Report for plugin-specific technical detail.
Attack Vector
An attacker authenticates to the WordPress site with any low-privilege account. The attacker then sends a request to a WP Maps plugin endpoint that returns sensitive embedded data in its response body. No user interaction is required beyond the attacker's own request. The attack occurs entirely over the network against the WordPress HTTP interface.
No public proof-of-concept exploit code is available for CVE-2026-28144 at the time of publication.
Detection Methods for CVE-2026-28144
Indicators of Compromise
- Unexpected HTTP requests from low-privilege authenticated user accounts to WP Maps plugin endpoints under /wp-admin/admin-ajax.php or plugin REST routes.
- Response payloads from WP Maps endpoints containing configuration keys, internal identifiers, or metadata fields not required by the map rendering client.
- Access patterns from subscriber-level accounts issuing repeated requests to plugin endpoints normally used only by administrators.
Detection Strategies
- Inspect WordPress access logs for authenticated requests targeting wp-google-map-plugin routes and correlate response sizes against baseline map queries.
- Deploy web application firewall rules to log and alert on responses from the plugin that include fields matching known sensitive data patterns.
- Audit installed plugin versions across WordPress fleets and flag any instance running WP Maps 4.9.6 or earlier.
Monitoring Recommendations
- Enable verbose logging on the WordPress REST API and AJAX handlers used by the plugin.
- Monitor for enumeration behavior where a single authenticated session requests multiple plugin endpoints in sequence.
- Track outbound response sizes from plugin endpoints and alert on statistical deviations that may indicate bulk data retrieval.
How to Mitigate CVE-2026-28144
Immediate Actions Required
- Identify all WordPress sites running the Flipper Code WP Maps plugin at version 4.9.6 or earlier.
- Update the plugin to a version later than 4.9.6 once the vendor publishes a fix.
- Restrict authenticated user creation and audit existing low-privilege accounts on affected sites.
- Review recent access logs for signs of enumeration against WP Maps endpoints.
Patch Information
At the time of publication, no fixed version is listed in the NVD entry for CVE-2026-28144. Consult the Patchstack Vulnerability Report for the latest vendor patch status and upgrade guidance.
Workarounds
- Temporarily deactivate the WP Maps plugin on affected WordPress sites until a patched version is available.
- Restrict access to plugin endpoints through a web application firewall rule limiting requests to administrator roles.
- Disable self-registration and remove unnecessary low-privilege accounts to reduce the population of users who can exploit the flaw.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
