The WP Go Maps plugin for WordPress stores marker data that can be configured as private unless approved by the site owner. Prior to version 10.0.10 the admin‑ajax fallback for the datatables route does not enforce the approval filter, so any visitor can hit the endpoint and receive the full set of marker records. The exposed data includes the marker title, category, address and description, which may contain location or other sensitive information. Because the data is disclosed without authentication or authorization, the impact is primarily a confidentiality breach – an attacker can gather private map entries and gain insight into site content or user activity.

WP Go Maps plugin versions prior to 10.0.10 are vulnerable. The CVE data does not specify a minimum version, so any installation of 10.0.9 or earlier is potentially exposed.

The vulnerability can be exploited remotely via an unauthenticated HTTP request to the admin‑ajax.php endpoint that returns table data. No reliance on user interaction is required. The EPSS score is not available and no CVSS value is published, so beyond its information disclosure nature the severity remains undetermined. Since it is not listed in the CISA KEV catalog, it is not known to have widespread exploitation, yet the data leak itself could enable more targeted attacks or privacy violations.