# CVE-2026-8385: WP Go Maps information disclosure in Datatables AJAX fallback

Source: https://junglewise.ai/threats/cve-2026-8385-wp-go-maps-information-disclosure-in-datatables-ajax-fallback  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-8385 · Severity: info · CVSS 5.3 · Published 2026-06-15

WP Go Maps is a popular WordPress plugin used to create and display interactive maps. A security flaw in the plugin allows unauthorized visitors to access map markers that were intended to be private or pending approval. This could result in the exposure of sensitive location data, including addresses, descriptions, and categories that the site owner has not yet authorized for public viewing.

Technologies: [WP Go Maps](https://junglewise.ai/threats/technologies/wp-go-maps). Vendors: [WP Go Maps](https://junglewise.ai/threats/vendors/wp-go-maps).

## Quick answers

**Is CVE-2026-8385 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8385 being exploited in the wild.

**How severe is CVE-2026-8385?** Informational severity, with a CVSS score of 5.3, published 15 June 2026.

**Which products and versions are affected?** WP Go Maps < 10.0.10.

**Is there a fix for CVE-2026-8385?** A patch was published on 2026-05-25: Fix available in version 10.0.10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8385 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-8385?** Check whether you run WP Go Maps at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The WP Go Maps plugin for WordPress contains an information disclosure vulnerability in its handling of the datatables route. While the standard REST API endpoint correctly filters for approved markers, the 'admin-ajax' fallback mechanism (specifically the 'wpgmza_rest_api_request' action) fails to apply the marker approval filter. An unauthenticated attacker can exploit this by sending a crafted POST request to 'admin-ajax.php' with the 'phpClass' parameter set to 'WPGMZA\\MarkerDataTable'. This allows the retrieval of all marker records for a given map ID, including those not yet approved by an administrator. The vulnerability was fixed in version 10.0.10.

## Affected products

- WP Go Maps WP Go Maps < 10.0.10

## Timeline

- 2026-05-25: disclosed: Publicly published by WPScan
- 2026-06-15: advisory: NVD published the CVE record
- 2026-05-25: patched: Fix available in version 10.0.10

## References

- [https://wpscan.com/vulnerability/984cad38-6d01-4956-8bf1-29585258780b/](https://wpscan.com/vulnerability/984cad38-6d01-4956-8bf1-29585258780b/)

## Related threats

- [WP Go Maps denial of service in map rendering](https://junglewise.ai/threats/cve-2026-84780-wp-go-maps-denial-of-service-in-map-rendering)
- [WP Go Maps SQL injection in Markers REST filter](https://junglewise.ai/threats/cve-2026-15381-wp-go-maps-sql-injection-in-markers-rest-filter)
- [WPGMaps WP Go Maps broken access control](https://junglewise.ai/threats/cve-2026-25466-wpgmaps-wp-go-maps-broken-access-control)
- [WP Go Maps WordPress plugin authorization bypass in REST API](https://junglewise.ai/threats/cve-2026-12238-wp-go-maps-wordpress-plugin-authorization-bypass-in-rest-api)
- [WP Go Maps information disclosure in single-marker REST endpoint](https://junglewise.ai/threats/cve-2026-8386-wp-go-maps-information-disclosure-in-single-marker-rest-endpoint)