WP Go Maps - Information Disclosure (CVE-2026-8386)
Description
The WP Go Maps WordPress plugin before 10.0.10 does not perform any approval-state filtering on its public single-marker REST endpoint, allowing unauthenticated users to retrieve marker records that an administrator has not yet approved for public display, including any PII placed in the address and description fields and the marker's geographic coordinates.
psychologyCrowdSec Analysis
CVE-2026-8386 is an information disclosure vulnerability in the WP Go Maps WordPress plugin before version 10.0.10. Because its public REST endpoint fails to filter markers by approval status, unauthenticated attackers can retrieve unpublished marker records, including potentially sensitive personal information, addresses, descriptions, and geographic coordinates.
CrowdSec has been tracking this vulnerability and its exploits since 23rd of July 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-8386 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers target the WordPress REST API endpoint /?rest_route=/wpgmza/v1/markers/<id>/ to retrieve marker records without authentication. Exploitation involves requesting marker IDs and inspecting JSON responses for fields such as approved, lat, lng, and map_id, which may expose unapproved PII and geographic coordinates.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-06-15 |
| Rule Released | 2026-07-23 |
| CrowdSec First Seen | 2026-08-05 |