Vulnerability · Published Aug 9, 2026 · Assigned by WPScan

CVE-2026-18464WP Maps Pro < 6.1.3 - Unauthenticated Denial of Service

High 7.5

In plain English

A high-severity uncontrolled resource consumption in WP MAPS PRO from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 58.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.

Affected products (as reported)

Vendor	Product	Versions
Unknown	WP MAPS PRO	0 – before 6.1.3

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://wpscan.com/vulnerability/45d1c2c2-c5da-43b6-a982-5323fb8d9014/ exploit, vdb-entry, technical-description