WP Maps Pro < 6.1.3 - Unauthenticated Denial of Service
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-400.
Summary
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | WP MAPS PRO | before 6.1.3 | 6.1.3 | Patch available | CNA |
- WP MAPS PRO VendorUnknown Affected before 6.1.3 Fixed in 6.1.3 Patch available CNA
Remediation
- Fix · CNA WP MAPS PRO (Unknown) Fixed in 6.1.3
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
WP MAPS PRO 6.1.3
2 records Highest priority Priority HIGH 2 HIGH
Other records, highest priority first
- TI-2026-15168 WP Maps Pro < 6.1.3 - Unauthenticated Local File InclusionPriority HIGH 68
Timeline
- 2026-10-02 Threatist record created from CVE-2026-18464
- 2026-10-03 Alias added: GHSA-r6mj-39cq-7p2p
References
Sources
- CVE-2026-18464 · CVE Program
- CVE-2026-18464 · NVD
- FIRST EPSS
- GHSA-r6mj-39cq-7p2p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences