CVE-2026-14839— Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure
Possible ATT&CK Techniques 1AI
T1005 · Data from Local SystemAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Mapster WP Maps | < 1.24.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-14839
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure
Source: CVE Program / CVE List V5
Vulnerability Description
The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished (draft, pending, private, and trashed) posts.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Mapster WP Maps 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Mapster WP Maps是WordPress基金会开源的一款地图展示组件。 WordPress Mapster WP Maps 1.24.0之前版本存在信息泄露漏洞，该漏洞源于对公共REST端点未执行授权或文章状态检查，可能导致未经身份验证的用户检索任意文章的标题和完整内容，包括未发布的文章（草稿、待审、私密、已删除）。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Mapster WP Maps | 0 ~ 1.24.0 | - |
II. Public POCs for CVE-2026-14839
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14839
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-14839 (1)
- 🔗 Mapster WP Maps < 1.24.0 – Unauthenticated Private and Draft Post Content Disclosure | CVE 2026-14839 | Plugin Vulnerabilities Read full article exploitvdb-entrytechnical-description
Same Patch Batch · Unknown · 2026-08-01 · 30 CVEs total
| CVE-2026-13604 | Pixelavo < 1.5.4 - Unauthenticated Facebook CAPI Event Injection via pixelavo_event AJAX | |
| CVE-2025-15669 | Bit Form < 3.1.4 - Admin+ Stored XSS via Conversational Form Progress Label | |
| CVE-2026-12966 | Direct Payments for WooCommerce < 2.5.3 - Unauthenticated Cross-Customer Order Tampering v | |
| CVE-2026-15932 | Support Genix Lite < 1.4.48 - Unauthenticated Arbitrary File Read via Path Traversal | |
| CVE-2026-14309 | Chat On Desk < 1.0.9 - Unauthenticated Account Takeover via Password Reset OTP Bypass | |
| CVE-2026-14596 | DynamicKit for Elementor < 1.0.3 - Unauthenticated Account Takeover via Password Reset Lin | |
| CVE-2026-14836 | Login/Signup Popup < 3.2.5 - Unauthenticated Account Takeover via Password Reset Rate Limi | |
| CVE-2026-14197 | Fluent Support < 2.3.1 - Agent+ Arbitrary Ticket Customer Reassignment via IDOR | |
| CVE-2026-15244 | HUSKY - Products Filter Professional for WooCommerce < 1.4.1 - Shop Manager+ Local File In | |
| CVE-2026-15368 | Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registrat | |
| CVE-2026-15234 | Codeless Page Builder <= 1.1.4 - Contributor+ Stored XSS via Shortcode Attribute | |
| CVE-2026-15262 | Admin Columns for ACF Fields <= 0.3.2 - Contributor+ Stored XSS via ACF Field Value Column | |
| CVE-2026-13157 | Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File Upload | |
| CVE-2026-13158 | Everest Toolkit <= 1.2.3 - Admin+ Arbitrary File Upload | |
| CVE-2026-10827 | Spectra (Ultimate Addons for Gutenberg) < 2.20.0 - Contributor+ Stored CSS Injection via B | |
| CVE-2026-14840 | YOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header Spoofing | |
| CVE-2026-13596 | Participants Database < 2.7.8.4 - Unauthenticated SQL Injection via List Search | |
| CVE-2026-13329 | WC Buckaroo BPE Gateway < 4.9.0 - Subscriber+ Unauthorized Order Refund | |
| CVE-2026-12696 | wpForo Forum < 3.1.2 - Subscriber+ Stored XSS via Profile Location Field | |
| CVE-2026-11882 | Builderall for WordPress < 3.0.2 - Unauthenticated OAuth Access Token Poisoning via Public |
Showing top 20 of 30 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Mapster WP Maps
Same vendor: Unknown
- CVE-2026-16296
Clearfy < 2.4.3 - Open Redirect via Cyrlitera 404 Handler - CVE-2026-16546
Wired Impact Volunteer Management < 2.8.2 - Subscriber+ Arbi - CVE-2026-16295
Clearfy < 2.4.3 - Subscriber+ Sensitive Information Disclosu - CVE-2026-16547
REST API Log < 1.7.1 - Unauthenticated Sensitive Log Data Di - CVE-2026-16548
Bit Assist < 1.8.2 - Unauthenticated Arbitrary File Upload v
V. Comments for CVE-2026-14839
No comments yet