CVE-2026-8385: WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Datatables AJAX Fallback
The WP Go Maps WordPress plugin before 10.0.10 does not properly enforce the marker approval filter on the admin-ajax fallback for its datatables route, allowing unauthenticated visitors to retrieve marker records that the site owner has not approved for public display, including their title, category, address and description fields.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/wp-go-mapsto a version that resolves this vulnerability.Fixed in 10.0.10
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8385?
The severity of CVE-2026-8385 is rated at 45, indicating a moderate risk.
How do I fix CVE-2026-8385?
To fix CVE-2026-8385, update the WP Go Maps plugin to version 10.0.10 or later.
What type of vulnerability is CVE-2026-8385?
CVE-2026-8385 is classified as an unauthenticated sensitive information disclosure vulnerability.
What information can be exposed due to CVE-2026-8385?
CVE-2026-8385 allows unauthenticated users to retrieve unapproved marker records, including titles and categories.
Which software is affected by CVE-2026-8385?
CVE-2026-8385 affects the WP Go Maps plugin version prior to 10.0.10.