CVE-2026-8385 is an information exposure vulnerability (CWE-200) in the WP Go Maps WordPress plugin prior to version 10.0.10. The vulnerability arises because the plugin does not properly enforce the marker approval filter on the admin-ajax fallback endpoint used by its datatables route. As a result, unauthenticated users can retrieve marker records that the site owner has not approved for public display, exposing potentially sensitive information such as marker titles, categories, addresses, and descriptions.

Unauthenticated attackers can access marker data that should be restricted, potentially exposing sensitive or private information about locations managed via the WP Go Maps plugin. This could lead to privacy violations or information leakage, depending on the nature of the marker data stored.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 10.0.10, upgrading to version 10.0.10 or later is likely recommended once confirmed by the vendor. Until then, restrict access to the admin-ajax endpoint or disable the affected datatables functionality if possible.