THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-14839 — The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished (draft, pending,

[NVD] CVE-2026-14839 — The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished (draft, pending,

mednvdPublished 2026-08-01

CVE-2026-14839 CVSS: None Published: 2026-08-01T07:16:30.947

The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished (draft, pending, private, and trashed) posts.

Indicators of compromise

CVE-2026-14839cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-14839