Executive brief
WP Go Maps is a popular WordPress plugin used to display interactive maps and location markers. A security flaw allows unauthorized visitors to access private location data that is still waiting for administrator approval. This could result in the exposure of sensitive information such as private addresses, descriptions, and geographic coordinates submitted by users.
Technical details
The WP Go Maps plugin before version 10.0.10 contains an information disclosure vulnerability in its public single-marker REST endpoint. The endpoint fails to verify the 'approved' status of a marker record before returning it to the requester. Because marker IDs are sequential integers, an unauthenticated attacker can enumerate the IDs via the REST API or the AJAX fallback mechanism to retrieve records in the moderation queue. This data includes the address, description, and precise GPS coordinates of markers that were intended to remain private until reviewed by an administrator. The issue is resolved in version 10.0.10.
Affected products
- WP Go Maps WP Go Maps < 10.0.10
Timeline
- 2026-05-25: disclosed: Publicly published by WPScan
- 2026-06-15: advisory: NVD publication date