CVE-2026-14839 — Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure

CVE-2026-14839

Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure PUBLISHED

Description (CNA)

The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished (draft, pending, private, and trashed) posts.

Affected (CNA)

Vendor / product	Versions
Unknown / Mapster WP Maps	affected 0 before 1.24.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/1994e67d-5fdc-445f-a09d-2b25d2b2f445/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.