Vulnerability · Published Aug 19, 2026 · Assigned by WPScan

CVE-2026-18466WP Maps < 4.9.8 - Subscriber+ Unlimited Autoloaded Option Creation

Medium 5.4

In plain English

A medium-severity improper access control in WP Maps from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 78.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request.

Affected products (as reported)

Vendor	Product	Versions
Unknown	WP Maps	0 – before 4.9.8

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

https://wpscan.com/vulnerability/2e12d9cf-520a-4602-aeee-7dbc26f79951/ exploit, vdb-entry, technical-description