CVE-2026-18464
WP Maps Pro < 6.1.3 - Unauthenticated Denial of Service
- State
- Published
- Severity
- 7.5 High
- Published
- Aug 9, 2026
- Updated
- Aug 10, 2026
- Reserved
- Jul 31, 2026
Description
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | CISA-ADP |
Weaknesses
- CWE-400 Uncontrolled Resource Consumption
Affected Products
| Product | Versions |
|---|---|
WP MAPS PROUnknown |
|
References
- https://wpscan.com/vulnerability/45d1c2c2-c5da-43b6-a982-5323fb8d9014/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.