CVEvulnerability

CVE-2026-18464

7.5 HIGH Published 2026-08-09 Modified 2026-08-26 Official page ↗
Status
Deferred
Published
2026-08-09
Last modified
2026-08-26
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400

Description

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.

Related

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References