CVE-2026-8385: WP Go Maps Information Disclosure Flaw

CVE-2026-8385 Overview

CVE-2026-8385 is an information disclosure vulnerability affecting the WP Go Maps WordPress plugin in versions before 10.0.10. The plugin fails to enforce the marker approval filter on the admin-ajax fallback for its datatables route. Unauthenticated attackers can query this endpoint and retrieve marker records that site administrators have not approved for public display. Exposed fields include marker title, category, address, and description. The flaw is categorized under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Unauthenticated remote attackers can enumerate unapproved map marker data, including addresses and descriptions intended to remain private on affected WordPress sites.

Affected Products

WP Go Maps WordPress plugin versions prior to 10.0.10
WordPress sites using the plugin's datatables route with marker approval workflows
Public-facing WordPress installations exposing the admin-ajax.php endpoint

Discovery Timeline

2026-06-15 - CVE-2026-8385 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-8385

Vulnerability Analysis

The vulnerability resides in the WP Go Maps plugin's handling of marker queries through the WordPress admin-ajax.php fallback path for its datatables route. The plugin implements a marker approval workflow that allows site owners to gate user-submitted markers before they appear publicly. The primary REST API endpoint enforces this approval filter, but the AJAX fallback handler does not. Unauthenticated visitors querying the fallback route receive unfiltered marker records. Exposed data includes the marker title, category, address, and description fields. The issue maps to [CWE-200] and corresponds to an EPSS score of 0.192%.

Root Cause

The plugin's datatables query handler in the admin-ajax fallback omits the WHERE clause logic that restricts results to approved markers. Authorization for read access exists in one execution path but is missing in the alternate path. This represents a server-side enforcement gap rather than a client-side issue, since the filter must be applied in the database query itself.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP POST request to the WordPress admin-ajax.php endpoint targeting the WP Go Maps datatables action. The request triggers the unfiltered query path and returns all marker records, including those pending administrator approval. No authentication, user interaction, or special privileges are required. The attack vector is network-based and works against any internet-exposed WordPress site running an affected plugin version.

No verified proof-of-concept code is published. See the WPScan Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-8385

Indicators of Compromise

Unauthenticated POST requests to /wp-admin/admin-ajax.php with action parameters referencing the WP Go Maps datatables route
High-volume or scripted access patterns from single IP addresses targeting the plugin's AJAX endpoint
Web server logs showing successful HTTP 200 responses to anonymous datatables queries containing large JSON payloads

Detection Strategies

Review WordPress access logs for repeated calls to admin-ajax.php with WP Go Maps action parameters originating from unauthenticated sessions
Compare the volume of returned markers in AJAX responses against the count of publicly approved markers in the database
Deploy web application firewall (WAF) rules that flag anonymous requests to plugin-specific AJAX actions

Monitoring Recommendations

Enable verbose logging on WordPress AJAX endpoints and forward logs to a centralized SIEM for correlation
Alert on anomalous data egress patterns from admin-ajax.php responses exceeding baseline payload sizes
Track plugin version inventory across WordPress fleets and flag installations running versions earlier than 10.0.10

How to Mitigate CVE-2026-8385

Immediate Actions Required

Update the WP Go Maps plugin to version 10.0.10 or later on all WordPress installations
Audit existing marker data to identify which unapproved records may have been exposed prior to patching
Review web server and WordPress access logs for evidence of unauthenticated queries against the datatables AJAX action

Patch Information

The vendor addressed the issue in WP Go Maps version 10.0.10. The fix enforces the marker approval filter on the admin-ajax fallback path so that unauthenticated queries return only approved records. Site administrators should apply the update through the WordPress plugin manager or by deploying the updated plugin package. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Restrict access to /wp-admin/admin-ajax.php for unauthenticated users via WAF rules when the action parameter targets WP Go Maps routes
Temporarily disable the WP Go Maps plugin on production sites until the patch is applied if sensitive marker data is staged for review
Remove or anonymize unapproved marker records containing sensitive address or description fields until the update is deployed

bash

# Example WordPress CLI command to update the plugin
wp plugin update wp-google-maps --version=10.0.10

# Verify installed version after update
wp plugin get wp-google-maps --field=version