Executive brief
WP Go Maps is a popular WordPress plugin used to create and display interactive maps. A security flaw in the plugin allows unauthorized visitors to access map markers that were intended to be private or pending approval. This could result in the exposure of sensitive location data, including addresses, descriptions, and categories that the site owner has not yet authorized for public viewing.
Technical details
The WP Go Maps plugin for WordPress contains an information disclosure vulnerability in its handling of the datatables route. While the standard REST API endpoint correctly filters for approved markers, the 'admin-ajax' fallback mechanism (specifically the 'wpgmza_rest_api_request' action) fails to apply the marker approval filter. An unauthenticated attacker can exploit this by sending a crafted POST request to 'admin-ajax.php' with the 'phpClass' parameter set to 'WPGMZA\\MarkerDataTable'. This allows the retrieval of all marker records for a given map ID, including those not yet approved by an administrator. The vulnerability was fixed in version 10.0.10.
Affected products
- WP Go Maps WP Go Maps < 10.0.10
Timeline
- 2026-05-25: disclosed: Publicly published by WPScan
- 2026-06-15: advisory: NVD published the CVE record
- 2026-05-25: patched: Fix available in version 10.0.10