CVE-2026-8386 Overview
CVE-2026-8386 is an information disclosure vulnerability in the WP Go Maps WordPress plugin before version 10.0.10. The plugin's public single-marker REST endpoint fails to filter records by approval state. Unauthenticated remote attackers can retrieve marker records that administrators have not yet approved for public display. Exposed data includes personally identifiable information (PII) placed in address and description fields, along with the marker's geographic coordinates. The flaw stems from missing access control on a REST API endpoint and falls under broken access control [CWE-284] and information exposure [CWE-200].
Critical Impact
Unauthenticated attackers can enumerate unapproved map marker records and harvest PII and geolocation data through a single REST API call.
Affected Products
- WP Go Maps WordPress plugin versions prior to 10.0.10
- WordPress sites running WP Go Maps with user-submitted markers enabled
- Sites relying on administrator approval workflows for public marker display
Discovery Timeline
- 2026-06-15 - CVE-2026-8386 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-8386
Vulnerability Analysis
The WP Go Maps plugin exposes a public REST endpoint for retrieving individual marker records. The endpoint accepts a marker identifier and returns the corresponding record without checking whether the marker has been approved by an administrator. Approval workflows exist in the plugin so that user-submitted markers remain hidden until reviewed. The single-marker endpoint bypasses that gate entirely.
An attacker can iterate marker identifiers and pull back every record stored in the database, regardless of approval status. Returned fields include the address string, the marker description, and latitude and longitude values. When site operators rely on these markers to collect submissions containing names, contact details, or location data, that information becomes accessible to anyone on the internet.
The issue is purely an authorization gap on a read endpoint. Exploitation requires no credentials, no user interaction, and only a standard HTTP client. The EPSS score of 0.206% reflects current exploitation likelihood, but the low complexity of the attack and the public nature of WordPress plugin code increase practical risk.
Root Cause
The single-marker REST handler omits an approval-state filter when querying marker records. List endpoints in the plugin apply the filter, but the per-marker lookup retrieves records by primary key without evaluating the approval column. Versions before 10.0.10 ship this handler without the necessary WHERE clause or capability check.
Attack Vector
The attack vector is network-based and unauthenticated. An attacker sends a GET request to the plugin's REST route for a specific marker ID. By incrementing the ID, the attacker enumerates the full marker table, including drafts and submissions awaiting moderation. No exploit code or proof of concept has been publicly released at the time of this writing. See the WPScan Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-8386
Indicators of Compromise
- Sequential or high-volume GET requests to the WP Go Maps single-marker REST endpoint from a single source IP
- Access log entries targeting /wp-json/ routes associated with the WP Go Maps plugin from unauthenticated sessions
- Spikes in REST API traffic referencing marker identifiers outside the published range
Detection Strategies
- Review WordPress access logs for enumeration patterns against WP Go Maps REST routes, particularly requests cycling through incremental marker IDs
- Deploy a web application firewall (WAF) rule that rate-limits unauthenticated requests to the plugin's REST endpoints
- Audit the plugin version reported by the WordPress site health screen and compare against the patched release
Monitoring Recommendations
- Forward WordPress and web server logs to a centralized logging platform and alert on REST endpoint abuse signatures
- Track outbound responses from the marker endpoint to identify unusually large response bodies indicative of bulk extraction
- Establish a baseline for legitimate REST API request rates and alert on deviations
How to Mitigate CVE-2026-8386
Immediate Actions Required
- Update the WP Go Maps plugin to version 10.0.10 or later on every affected WordPress site
- Review existing marker records and remove any unapproved entries that contain sensitive PII before the patch is applied
- Notify users whose submitted data may have been exposed if marker submissions contained personal information
Patch Information
The vendor addressed CVE-2026-8386 in WP Go Maps version 10.0.10 by adding approval-state filtering to the single-marker REST endpoint. Site administrators should apply the update through the WordPress plugin management interface or via WP-CLI. Refer to the WPScan Vulnerability Report for the advisory details.
Workarounds
- Temporarily disable the WP Go Maps plugin until the patched version is installed
- Restrict access to the plugin's REST routes at the web server or WAF layer for unauthenticated requests
- Disable user-submitted markers in plugin settings to prevent new unapproved records from being created
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
