WP Maps CVE-2026-16265

Exploitation requires a valid WordPress subscriber account (or higher) on the target site - confirmed by the CVSS vector PR:L. The vulnerability is specifically located in an AJAX action handler that lacks a WordPress capability check, meaning the action must be reachable via the standard wp-admin/admin-ajax.php endpoint. Sites with open user registration are at elevated risk because any internet user can self-register a subscriber account without admin approval. Exploitation is limited by the need for authentication (no unauthenticated path exists per the CVSS PR:L metric), the requirement that WP Maps be installed and active, and the SSVC finding that the attack is not automatable (likely due to session/nonce requirements inherent to WordPress AJAX). Impact is strictly availability - no data exfiltration or integrity modification is possible via this flaw.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately captures the network-reachable, low-complexity nature of the flaw but correctly reflects that a subscriber account (PR:L) is required, limiting unauthenticated exposure. EPSS at 0.14% (4th percentile) signals very low probability of observed exploitation in the near term, consistent with the SSVC assessment that the attack is not automatable and technical impact is only partial. The existence of a public POC is a meaningful escalation signal - exploitation is feasible for anyone with a WordPress account on the target site. Sites that allow open user registration are at materially higher risk than those with invite-only or closed registration. There is no confidentiality or integrity impact; the sole risk is availability. The combination of low EPSS, no KEV, and a PR:L prerequisite places this in a secondary priority tier for most organizations, unless open registration is enabled.

An attacker registers or obtains a subscriber-level account on a target WordPress site running WP Maps before 4.9.7, then sends a crafted HTTP POST request to wp-admin/admin-ajax.php with the vulnerable action parameter. The server processes the request without authorization checks, triggering recursive function calls that consume PHP stack memory and CPU until the web server process crashes or becomes unresponsive; a public proof-of-concept demonstrates this technique. Repeated requests can sustain the outage, effectively keeping the site offline.