# CVE-2026-8386: WP Go Maps - Information Disclosure

> Live exploitation tracking for CVE-2026-8386 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-8386

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 5.3
- **Public exploit available:** Yes
- **Affected products:** N/A WP Go Maps
- **Weaknesses:** CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
- **Tags:** wordpress, cms

## Description

The WP Go Maps  WordPress plugin before 10.0.10 does not perform any approval-state filtering on its public single-marker REST endpoint, allowing unauthenticated users to retrieve marker records that an administrator has not yet approved for public display, including any PII placed in the address and description fields and the marker's geographic coordinates.

## CrowdSec analysis

[CVE-2026-8386](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-8386) is an information disclosure vulnerability in the WP Go Maps WordPress plugin before version 10.0.10. Because its public REST endpoint fails to filter markers by approval status, unauthenticated attackers can retrieve unpublished marker records, including potentially sensitive personal information, addresses, descriptions, and geographic coordinates.

CrowdSec has been tracking this vulnerability and its exploits since 23rd of July 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-8386 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target the WordPress REST API endpoint `/?rest_route=/wpgmza/v1/markers/<id>/` to retrieve marker records without authentication. Exploitation involves requesting marker IDs and inspecting JSON responses for fields such as `approved`, `lat`, `lng`, and `map_id`, which may expose unapproved PII and geographic coordinates.

## Timeline

- 2026-06-15: CVE Published. CVE-2026-8386 is published to NVD.
- 2026-07-23: Rule Released. CrowdSec releases a rule to detect CVE-2026-8386 exploitation attempts against the CrowdSec Network.
- 2026-08-05: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-8386 for the first time.

## References

- https://wpscan.com/vulnerability/fa7f5cb0-abe2-4079-9290-e0e4dc89f27f/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8386.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-8386) follows observed exploitation activity for CVE-2026-8386. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.