| Reporter | Title | Published | Views | Family All 12 |
|---|---|---|---|---|
 | Exploit for Interpretation Conflict in Wordpress | 4 Aug 202616:43 | – | githubexploit |
| Exploit for Interpretation Conflict in Wordpress | 4 Aug 202613:35 | – | githubexploit |
 | CVE-2026-14839 | 1 Aug 202606:00 | – | attackerkb |
 | CVE-2026-14839 | 1 Aug 202614:47 | – | circl |
 | CVE-2026-14839 Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure | 1 Aug 202606:00 | – | cvelist |
 | EUVD-2026-51711 | 1 Aug 202606:00 | – | euvd |
 | wp2exp-2026 | 18 Aug 202621:55 | – | kitploit |
 | CVE-2026-14839 | 1 Aug 202607:16 | – | nvd |
 | WordPress Mapster WP Maps plugin < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure vulnerability | 1 Aug 202606:00 | – | patchstack |
 | PT-2026-67051 | 1 Aug 202600:00 | – | ptsecurity |
10
Node
[
{
"vendor": "Unknown",
"product": "Mapster WP Maps",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThan": "1.24.0"
}
],
"defaultStatus": "unaffected"
}
]| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| id | query param | /wp-json/mapster-wp-maps/feature?id=N | Unauthenticated access to post titles and full content via Mapster REST endpoint (CVE-2026-14839). | CWE-200 |
| query param | /wp-json/mapster-wp-maps/feature?id=N | Unauthenticated access to post titles and full content via Mapster REST endpoint (CVE-2026-14839). | CWE-200 | |
| batch | request body | /wp-json/batch/v1 | REST batch route vulnerability enabling crafted batch requests; potential RCE (CVE-2026-63030). | CWE-200 |
| roles | request body | /wp/v2/users | Pre-auth admin creation via WP REST API (POST /wp/v2/users) to grant administrator privileges. | CWE-200 |
| username | request body | /wp/v2/users | Pre-auth admin creation via WP REST API (POST /wp/v2/users) to grant administrator privileges. | CWE-200 |
| password | request body | /wp/v2/users | Pre-auth admin creation via WP REST API (POST /wp/v2/users) to grant administrator privileges. | CWE-200 |
| action | query param | /wp-admin/admin-ajax.php | Write webshell via admin-ajax.php?action=edit-theme-plugin-file as part of the exploitation chain. | CWE-200 |
| action | query param | /wp-admin/update.php | Upload plugin via update.php?action=upload-plugin (plugin upload vector). | CWE-200 |
| log | request body | /wp-login.php | WordPress login endpoint used to establish an authenticated session for exploitation. | CWE-200 |
| pwd | request body | /wp-login.php | WordPress login endpoint used to establish an authenticated session for exploitation. | CWE-200 |
10
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
26 Aug 2026 16:31Current
5.9Medium risk
Vulners AI Score5.9
CVSS 3.17.5
EPSS0.00434
SSVC