HIGH 7.5 NVD

CVE-2026-14839

The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated u

The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished (draft, pending, private, and trashed) posts.

References

https://wpscan.com/vulnerability/1994e67d-5fdc-445f-a09d-2b25d2b2f445/

Published: 2026-08-01 · Source: NVD · Feed updated: 2026-08-04

This high severity vulnerability with a CVSS score of 7.5 was published on 2026-08-01 via NVD.

vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.