Vulnerability · Published Jun 15, 2026 · Assigned by WPScan

CVE-2026-8385WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Datatables AJAX Fallback

Medium 5.3

In plain English

A medium-severity information exposure in WP Go Maps from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.8%top 43.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

The WP Go Maps WordPress plugin before 10.0.10 does not properly enforce the marker approval filter on the admin-ajax fallback for its datatables route, allowing unauthenticated visitors to retrieve marker records that the site owner has not approved for public display, including their title, category, address and description fields.

Affected products (as reported)

Vendor	Product	Versions
Unknown	WP Go Maps	0 – before 10.0.10

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://wpscan.com/vulnerability/984cad38-6d01-4956-8bf1-29585258780b/ exploit, vdb-entry, technical-description