CVE-2026-8385Disclosure

LOWCVSS 5.3 · MEDIUM

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The WP Go Maps WordPress plugin before 10.0.10 does not properly enforce the marker approval filter on the admin-ajax fallback for its datatables route, allowing unauthenticated visitors to retrieve marker records that the site owner has not approved for public display, including their title, category, address and description fields.

Back to dashboard

1.5/ 10 priority

Sources & remediation

Other references

https://wpscan.com/vulnerability/984cad38-6d01-4956-8bf1-29585258780b/

Weakness type (CWE)

CWE-200

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
6 mentions across 3 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 2 signals
Technical details provided in 5 signals
Disclosure: 4 classified signals
General: 1 classified signal
Peaked 1d ago at 3 mentions (2026-06-15); latest day: 2
6 total mentions across 3 days

Deep dive

Activity timeline6 mentions / 3d

Signal classification3 categories

Disclosure

466.7%

PoC

116.7%

General

116.7%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-14	1	PoC1
2026-06-15	3	Disclosure3
2026-07-23	2	Disclosure1General1

Full discourse6 posts

pdnuclei-bot@pdnuclei_bot98d
Disclosure
🚨 CVE-2026-8385 - medium 🚨 WordPress WP Go Maps < 10.0.10 - Unauthenticated Marker Data Disclosure > WP Go Maps WordPress plugin < 10.0.10 contains an information disclosure vulnerabilit... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-8385 @pdnuclei #NucleiTemplate...
Post summary
The message announces a medium‑severity information disclosure vulnerability (CVE‑2026‑8385) affecting WP Go Maps plugin before version 10.0.10, offering a link for additional details.
00011238
1.1K followersView on X
MalwareObserver@MalwareObserver98d
General
🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-8385](https://wpscan.com/vulnerability/984cad38-6d01-4956-8bf1-29585258780b/) The WP Go... https://wpscan.com/vulnerability/984cad38-6d01-4956-8bf1-29585258780b/ #PatchManagement #Vulnerability #CVE
Post summary
The tweet merely posts a notification link to CVE‑2026‑8385 with no additional technical or exploit details.
0000026
13 followersView on X
Infoflowcloud@infoflowcloud136d
Disclosure
🚨*CVE* CVE-2026-8385 The WP Go Maps WordPress plugin before 10.0.10 does not properly enforce the marker approval filter on the admin-ajax fallback for its datatables route, allowing unaut… https://www.cve.org/CVERecord?id=CVE-2026-8385 ----- Traducción: CVE-2026-8385 El … http://infoflow.cloud`
Post summary
The note announces CVE‑2026‑8385 as a flaw in WP Go Maps’ admin‑ajax fallback that ignores marker approval, but provides no PoC, exploit, or patch information.
0000063
79 followersView on X
CVE@CVEnew136d
Disclosure
CVE-2026-8385 The WP Go Maps WordPress plugin before 10.0.10 does not properly enforce the marker approval filter on the admin-ajax fallback for its datatables route, allowing unaut… https://www.cve.org/CVERecord?id=CVE-2026-8385
Post summary
CVE‑2026‑8385 is a disclosed vulnerability in the WP Go Maps WordPress plugin (versions <10.0.10) that fails to apply the marker approval filter on the admin‑ajax fallback for its datatables route, potentially enabling unauthorized actions.
00000331
57.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds136d
Disclosure
CVE-2026-8385 Unauthenticated Marker Data Disclosure in WP Go Maps WordPress Plu... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-8385 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The post reports the discovery of CVE‑2026‑8385, an unauthenticated marker data disclosure vulnerability in the WP Go Maps WordPress plugin, and links to a vulnerability details page.
0000051
4.0K followersView on X
Atomic Edge@atomicedgeWAF137d
PoC
https://atomicedge.io/cve-proof/cve-2026-8385-wp-google-maps-version-10-0-09-medium-vulnerability-proof-of-concept CVE-2026-8385 wp-google-maps (CVSS Score 5.3) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomiced…
Post summary
CVE‑2026‑8385 targets the wp‑google‑maps WordPress plugin (CVSS 5.3) and a proof‑of‑concept has been posted, but no evidence of active exploitation or patch status is provided.
0000036
9 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-8385

MalwareObserver[verified]@MalwareObserverGeneral

The tweet merely posts a notification link to CVE‑2026‑8385 with no additional technical or exploit details.

pdnuclei-bot@pdnuclei_botDisclosure

The message announces a medium‑severity information disclosure vulnerability (CVE‑2026‑8385) affecting WP Go Maps plugin before version 10.0.10, offering a link for additional details.

Infoflowcloud@infoflowcloudDisclosure

The note announces CVE‑2026‑8385 as a flaw in WP Go Maps’ admin‑ajax fallback that ignores marker approval, but provides no PoC, exploit, or patch information.

CVE@CVEnewDisclosure

CVE‑2026‑8385 is a disclosed vulnerability in the WP Go Maps WordPress plugin (versions <10.0.10) that fails to apply the marker approval filter on the admin‑ajax fallback for its datatables route, potentially enabling unauthorized actions.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post reports the discovery of CVE‑2026‑8385, an unauthenticated marker data disclosure vulnerability in the WP Go Maps WordPress plugin, and links to a vulnerability details page.

Atomic Edge@atomicedgeWAFPoC

CVE‑2026‑8385 targets the wp‑google‑maps WordPress plugin (CVSS 5.3) and a proof‑of‑concept has been posted, but no evidence of active exploitation or patch status is provided.