CVE-2026-8385 Scanner

The WP Go Maps plugin for WordPress is a widely used plugin that allows users to create custom maps with multiple locations, providing a great tool for websites that need to display geographical information easily. Website administrators, businesses, and bloggers commonly use this plugin as it lets them showcase locations with detailed information directly on their WordPress sites. It is adaptable for various purposes like showing customer locations, event venues, or tourist spots. The plugin is designed for ease of use and can integrate with different map services, offering flexible and detailed location services. It serves a wide variety of users ranging from small businesses that want to highlight store locations to informational or educational blogs needing to represent data geographically. It plays a significant role in enhancing user engagement by providing visually interactive and informative maps.

Information Disclosure vulnerabilities occur when sensitive information is exposed to unauthorized entities. Such vulnerabilities can inadvertently provide attackers with detailed insights about the system, leading to further exploitation. In the context of the WP Go Maps plugin, this vulnerability allows unauthenticated attackers to access marker data meant for administrative review, including titles, categories, addresses, and descriptions. This exposure can lead to the inadvertent release of sensitive information if system configurations do not appropriately secure this data. The vulnerability primarily impacts the confidentiality aspect of the security model, as it allows information traditionally meant for internal consumption to be accessed publicly. Such vulnerabilities typically stem from insufficient access controls and enforcement of data validation or filtering policies.

The WP Go Maps plugin has an improper enforcement configuration in its marker approval filter. Due to this misconfiguration, the fallback method for admin-ajax handling of the datatables route can be exploited. Specifically, unauthenticated users can query this endpoint via a crafted POST request to 'wp-admin/admin-ajax.php', causing it to return unapproved marker data. This endpoint, intended for use by administrators, thus exposes the marker data without proper checks. The vulnerability arises from failing to restrict access controls to sensitive plugin operations, allowing unauthorized data exposure. Attackers can exploit this vulnerability by sending crafted requests containing specific action and route parameters, which trigger the retrieval of these sensitive entries.

When exploited, this vulnerability in the WP Go Maps plugin leads to the exposure of sensitive marker data. Malicious users can gain insights into coordinates, locations, and various data fields that could have been meant for private or internal use. The unauthorized disclosure of this data can lead to information leakage that compromises the privacy and security of the system. Adversaries can leverage this information to orchestrate targeted attacks, social engineering, or obtain competitive intelligence. Additionally, clients' or users' private details and annotations associated with map markers become public, which may lead to reputational damage or regulatory implications for the site's operators. Overall, it poses a significant risk to confidentiality and potential data protection breaches.

REFERENCES

• https://wpscan.com/vulnerability/984cad38-6d01-4956-8bf1-29585258780b/
• https://nvd.nist.gov/vuln/detail/CVE-2026-8385