EUVD-2026-54878
GHSA-r6mj-39cq-7p2p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-accessible unauthenticated AJAX endpoint with no prerequisites; sole impact is availability via resource exhaustion, with no confidentiality or integrity consequence.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
5DescriptionCVE.org
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.
AnalysisAI
Unauthenticated denial-of-service in WP Maps Pro WordPress plugin before 6.1.3 allows any remote attacker without credentials to exhaust server resources by triggering uncontrolled recursion through an exposed AJAX endpoint. The plugin fails to perform a capability check on at least one AJAX action accessible via the wp-ajax-nopriv_ hook and does not restrict the operation that action dispatches. No public exploit code has been identified at time of analysis and EPSS exploitation probability is very low (0.14%, 4th percentile), though successful exploitation can fully degrade availability of the affected WordPress installation.
Technical ContextAI
WP Maps Pro is a premium WordPress mapping plugin. The vulnerability is rooted in CWE-400 (Uncontrolled Resource Consumption): a WordPress AJAX action registered by the plugin omits any capability check - typically implemented via current_user_can() - and is accessible to unauthenticated users through the wp-ajax-nopriv_ hook. The action dispatches an operation that triggers uncontrolled recursion, a condition where a function invokes itself without adequate depth limits or termination guards, consuming PHP call-stack depth and server memory until the process crashes or the host becomes unresponsive. The affected version range spans all releases prior to 6.1.3, as documented by WPScan under EUVD-2026-54878. No CPE string was provided in source data; the product is identified by its WordPress plugin slug and version range only.
RemediationAI
Upgrade WP Maps Pro to version 6.1.3 or later, which is confirmed available from the vendor per WPScan, NVD, and EUVD-2026-54878 and introduces the required capability check on the affected AJAX action. If immediate upgrade cannot be scheduled, the most effective compensating control is to deactivate the WP Maps Pro plugin entirely, eliminating the attack surface at the cost of losing mapping functionality on the site. An alternative server-side mitigation is to configure a WAF rule blocking unauthenticated POST requests to wp-admin/admin-ajax.php that match the specific vulnerable action parameter; however, the exact action name has not been publicly disclosed, making precise WAF tuning difficult without source code inspection or vendor guidance, and an overly broad rule may break legitimate plugin functionality. No other vendor-documented workarounds are known.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today