CVE-2026-14839: CWE-200 Information Exposure in Mapster WP Maps
The Mapster WP Maps WordPress plugin before version 1.24.0 contains an information exposure vulnerability. It fails to perform authorization or post-status checks on a public REST endpoint, allowing unauthenticated users to access the title and full content of any post, including unpublished posts such as drafts, pending, private, and trashed posts.
AI Analysis
Technical Summary
CVE-2026-14839 is an information exposure vulnerability (CWE-200) in the Mapster WP Maps WordPress plugin versions prior to 1.24.0. The plugin does not enforce authorization or verify post status on a public REST endpoint, enabling unauthenticated attackers to retrieve sensitive content from any post regardless of its publication status. This includes access to unpublished content that should normally be restricted.
Potential Impact
Unauthenticated users can access sensitive information from posts that are not publicly available, including drafts, pending, private, and trashed posts. This exposure can lead to leakage of confidential or sensitive content that site administrators intended to keep private.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 1.24.0, upgrading to version 1.24.0 or later is likely to address the issue once an official fix is released. Until then, restrict access to the REST endpoint or disable the plugin if possible to prevent unauthorized data exposure.
CVE-2026-14839: CWE-200 Information Exposure in Mapster WP Maps
Description
The Mapster WP Maps WordPress plugin before version 1.24.0 contains an information exposure vulnerability. It fails to perform authorization or post-status checks on a public REST endpoint, allowing unauthenticated users to access the title and full content of any post, including unpublished posts such as drafts, pending, private, and trashed posts.
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-14839 is an information exposure vulnerability (CWE-200) in the Mapster WP Maps WordPress plugin versions prior to 1.24.0. The plugin does not enforce authorization or verify post status on a public REST endpoint, enabling unauthenticated attackers to retrieve sensitive content from any post regardless of its publication status. This includes access to unpublished content that should normally be restricted.
Potential Impact
Unauthenticated users can access sensitive information from posts that are not publicly available, including drafts, pending, private, and trashed posts. This exposure can lead to leakage of confidential or sensitive content that site administrators intended to keep private.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 1.24.0, upgrading to version 1.24.0 or later is likely to address the issue once an official fix is released. Until then, restrict access to the REST endpoint or disable the plugin if possible to prevent unauthorized data exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-06T11:07:28.622Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a6d96d3bf32cb7a344cedcf
Added to database: 08/01/2026, 06:48:51 UTC
Last enriched: 08/01/2026, 07:08:28 UTC
Last updated: 08/01/2026, 16:27:10 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.