WP Go Maps EUVD-2026-69942

No authentication is required - CVSS PR:N confirms unauthenticated exploitation. The attack is network-accessible (AV:N) with low complexity (AC:L) and requires no user interaction (UI:N). The sole prerequisite is that the WP Go Maps plugin version <= 10.1.08 is installed and active on a WordPress site reachable from the network. The impact is limited to partial availability degradation (A:L); complete site takedown likely requires sustained, high-volume request flooding rather than a single request. The vulnerability does not affect confidentiality or integrity, and scope is unchanged (S:U), meaning impact is confined to the WordPress installation itself.

The CVSS 3.1 base score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L accurately reflects the threat profile: network-accessible, no authentication or user interaction required, but limited to partial availability impact (A:L). There is no confidentiality or integrity component, which correctly constrains the score. The unauthenticated, low-complexity attack conditions make this trivially exploitable in terms of access requirements, though the bounded availability impact (A:L rather than A:H) means a sustained, high-volume attack is likely needed to cause meaningful disruption rather than a single request. No EPSS score was provided in the intelligence data, and the absence of KEV listing and public exploit code suggests this has not been broadly weaponized. Realistically, even a mid-sized municipal IT team in rybnik managing a WordPress estate should prioritize patching this as routine maintenance rather than treating it as an emergency, given the limited impact ceiling and absence of active exploitation signals. The primary real-world concern is shared-hosting environments where a DoS against one WordPress site could affect co-tenants.

An attacker identifies a WordPress site running WP Go Maps <= 10.1.08 and sends a high volume of crafted unauthenticated HTTP requests to the plugin's resource-intensive endpoint. Without throttling controls, the server allocates resources for each request, progressively exhausting PHP workers, database connections, or memory until the site becomes slow or unresponsive to legitimate visitors. No exploit code has been publicly confirmed, but the low attack complexity means a simple scripted loop is sufficient.