The WP Go Maps WordPress plugin versions earlier than 10.0.10 expose a public REST endpoint that retrieves a single marker record. The endpoint ignores the marker’s approval state, allowing any visitor to request details of markers that an administrator has not yet approved for public display. Because marker records may contain personally identifying information, such as full addresses and descriptive text, the flaw enables unauthorized disclosure of private data and potential location tracking of individuals.

This vulnerability affects the WP Go Maps plugin for WordPress, specifically any installation running a version earlier than 10.0.10. The flaw exists in the plugin’s public single‑marker REST API, which is enabled by default for all sites using the plugin.

The CVSS score is 5.3, and the EPSS score is <1%; the issue is also not listed in the CISA KEV catalog. Attackers do not need credentials or special privileges to exploit the flaw – an unauthenticated user can request any marker ID and receive the data. Consequently, the exposure risk is high for any site that includes personal or sensitive content in markers and has the default REST endpoint accessible. The lack of any mitigation from the vendor beyond the upgrade path means that the vulnerability will remain exploitable until the plugin is updated.