CVE-2026-14839— Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure
Quick assessment
Affected
Unknown Mapster WP Maps
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress Mapster WP Maps是WordPress基金会开源的一款地图展示组件。 WordPress Mapster WP Maps 1.24.0之前版本存在信息泄露漏洞，该漏洞源于对公共REST端点未执行授权或文章状态检查，可能导致未经身份验证的用户检索任意文章的标题和完整内容，包括未发布的文章（草稿、待审、私密、已删除）。
Possible ATT&CK Techniques 1 AI
T1005 · Data from Local SystemAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Mapster WP Maps | < 1.24.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-14839
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure
Source: CVE Program / CVE List V5
Vulnerability Description
The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished (draft, pending, private, and trashed) posts.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Mapster WP Maps 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Mapster WP Maps是WordPress基金会开源的一款地图展示组件。 WordPress Mapster WP Maps 1.24.0之前版本存在信息泄露漏洞，该漏洞源于对公共REST端点未执行授权或文章状态检查，可能导致未经身份验证的用户检索任意文章的标题和完整内容，包括未发布的文章（草稿、待审、私密、已删除）。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Mapster WP Maps | 0 ~ 1.24.0 | - |
|
II. Public POCs for CVE-2026-14839
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14839
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-14839 (1)
-
🔗 Mapster WP Maps < 1.24.0 – Unauthenticated Private and Draft Post Content Disclosure | CVE 2026-14839 | Plugin Vulnerabilities Read full article exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-08-01 · 30 CVEs total
| CVE-2026-13604 | Pixelavo < 1.5.4 - Unauthenticated Facebook CAPI Event Injection via pixelavo_event AJAX | |
| CVE-2025-15669 | Bit Form < 3.1.4 - Admin+ Stored XSS via Conversational Form Progress Label | |
| CVE-2026-12966 | Direct Payments for WooCommerce < 2.5.3 - Unauthenticated Cross-Customer Order Tampering v | |
| CVE-2026-15932 | Support Genix Lite < 1.4.48 - Unauthenticated Arbitrary File Read via Path Traversal | |
| CVE-2026-14309 | Chat On Desk < 1.0.9 - Unauthenticated Account Takeover via Password Reset OTP Bypass | |
| CVE-2026-14596 | DynamicKit for Elementor < 1.0.3 - Unauthenticated Account Takeover via Password Reset Lin | |
| CVE-2026-14836 | Login/Signup Popup < 3.2.5 - Unauthenticated Account Takeover via Password Reset Rate Limi | |
| CVE-2026-14197 | Fluent Support < 2.3.1 - Agent+ Arbitrary Ticket Customer Reassignment via IDOR | |
| CVE-2026-15244 | HUSKY - Products Filter Professional for WooCommerce < 1.4.1 - Shop Manager+ Local File In | |
| CVE-2026-15368 | Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registrat | |
| CVE-2026-15234 | Codeless Page Builder <= 1.1.4 - Contributor+ Stored XSS via Shortcode Attribute | |
| CVE-2026-15262 | Admin Columns for ACF Fields <= 0.3.2 - Contributor+ Stored XSS via ACF Field Value Column | |
| CVE-2026-13157 | Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File Upload | |
| CVE-2026-13158 | Everest Toolkit <= 1.2.3 - Admin+ Arbitrary File Upload | |
| CVE-2026-10827 | Spectra (Ultimate Addons for Gutenberg) < 2.20.0 - Contributor+ Stored CSS Injection via B | |
| CVE-2026-14840 | YOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header Spoofing | |
| CVE-2026-13596 | Participants Database < 2.7.8.4 - Unauthenticated SQL Injection via List Search | |
| CVE-2026-13329 | WC Buckaroo BPE Gateway < 4.9.0 - Subscriber+ Unauthorized Order Refund | |
| CVE-2026-12696 | wpForo Forum < 3.1.2 - Subscriber+ Stored XSS via Profile Location Field | |
| CVE-2026-11882 | Builderall for WordPress < 3.0.2 - Unauthenticated OAuth Access Token Poisoning via Public |
Showing top 20 of 30 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Mapster WP Maps
-
CVE-2026-39720
WordPress Mapster WP Maps plugin <= 2.0.4 - Cross Site Scrip -
CVE-2026-12954
Mapster WP Maps <= 1.23.0 - Authenticated (Subscriber+) Arbi -
CVE-2025-9044
Mapster WP Maps <= 1.20.0 - Authenticated (Contributor+) Sto -
CVE-2024-10592
Mapster WP Maps <= 1.6.0 - Authenticated (Contributor+) Stor -
CVE-2024-9235
Mapster WP Maps <= 1.5.0 - Incorrect Authorization to Authen
Same vendor: Unknown
-
CVE-2026-92429
Rede Itaú for WooCommerce 3.7.1 - 5.5.2 - Unauthenticated Or -
CVE-2026-92428
Rede Itaú for WooCommerce < 5.5.3 - Unauthenticated Order St -
CVE-2026-103324
Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Un -
CVE-2026-96537
Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish -
CVE-2026-74920
Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode
V. Comments for CVE-2026-14839
No comments yet