ghoxtbyte/cve-2026-16265Technical advisory and research notes for CVE-2026-16265, a Subscriber+ denial-of-service flaw in the WP Maps WordPress plugin fixed in version 4.9.7.
Security research notes for CVE-2026-16265, a denial-of-service vulnerability affecting the WordPress WP Maps plugin.
This repository is intended as a technical reference for an already disclosed vulnerability. It does not include a weaponized denial-of-service script.
| Item | Details |
|---|
| CVE | CVE-2026-16265 |
| Product | WP Maps |
| Affected versions | < 4.9.7 |
| Fixed version | 4.9.7 |
| Weakness | CWE-400 — Uncontrolled Resource Consumption |
| Attack requirement | Authenticated user with Subscriber-level privileges or higher |
| Severity | 6.5 (CVSS 3.1) |
| Published | 2026-08-07 |
| Finder | Mohammad Aghdasi |
| CNA / Coordinator | WPScan |
A missing capability check in an AJAX action, combined with insufficient restriction of the dispatched operation, can allow a low-privileged authenticated user to trigger uncontrolled recursion. Repeated resource consumption may exhaust server capacity and cause a denial of service.
The security impact is limited to availability: successful exploitation can consume enough server resources to make the affected WordPress installation slow or unavailable. The published CVSS vector does not indicate confidentiality or integrity impact.
The affected code path combines two security problems:
That combination makes it possible to reach a recursive execution path that continuously consumes server resources.
An attacker meeting the access requirement above may cause:
The practical impact depends on the hosting environment, PHP limits, worker configuration, caching layer, and upstream rate limiting.
Affected: WP Maps < 4.9.7
Fixed: upgrade to 4.9.7 or later.
Administrators should update the plugin and avoid exposing outdated versions to untrusted users or traffic.
The vulnerable behavior is reachable through a WordPress AJAX action. The handler does not correctly enforce authorization and permits an unsafe operation to reach a recursive execution path.
No high-volume or automated denial-of-service proof of concept is included in this repository. Verification should be performed only in an isolated test environment with resource limits in place.
See docs/technical-analysis.md for a concise analysis of the issue.
6.5 (CVSS 3.1)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
The vulnerability was coordinated through WPScan, which is listed as the CNA/coordinator in the public CVE record.
The public record credits Mohammad Aghdasi as the finder.
Only dates confirmed by the public advisory are included here; no private disclosure timeline is claimed.
Upgrade the affected plugin to 4.9.7 or later.
Defense-in-depth measures can also reduce exposure:
These controls are supplementary and should not replace the vendor update.
The material in this repository is provided for security research, vulnerability management, and defensive testing. Test only systems you own or are explicitly authorized to assess.
Documentation in this repository is released under the MIT License.