high7.5
CVE-2026-18464
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users,…
Impact
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.
Affected products
| Product | Affected versions |
|---|---|
| WP MAPS PRO WordPress Plugin | before 6.1.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.