WordPress Plugin Vulnerabilities

Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure

Description

The plugin does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished (draft, pending, private, and trashed) posts.

Proof of Concept

Affects Plugins

Plugin icon
mapster-wp-maps
Fixed in 1.24.0

References

CVE
CVE-2026-14839

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Alexander Jurkschat
Submitter
Alexander Jurkschat
Verified
Yes
WPVDB ID
1994e67d-5fdc-445f-a09d-2b25d2b2f445

Timeline

Publicly Published
2026-07-20 (about 13 days ago)
Added
2026-07-20 (about 12 days ago)
Last Updated
2026-07-20 (about 12 days ago)

Other

Published
Title
Published
2025-04-04
Title
Ai Image Alt Text Generator for WP <= 1.1.9 - Subscriber+ Sensitive Information Exposure
Published
2025-04-04
Title
KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin <= 1.7.4 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
Published
2025-01-03
Title
Post/Page Copying Tool < 2.0.1 - Unauthenticated Sensitive Information Exposure
Published
2026-06-17
Title
Appointment Booking Calendar < 1.4.02 - Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter
Published
2023-12-05
Title
Ultimate Dashboard < 3.7.11 - Login Page Disclosure on Multi-site