ghoxtbyte/cve-2026-18464Security advisory and technical research notes for CVE-2026-18464, an unauthenticated denial-of-service flaw in the WP Maps Pro WordPress plugin fixed in 6.1.3.
Security research notes for CVE-2026-18464, a denial-of-service vulnerability affecting the WordPress WP MAPS PRO plugin.
This repository is intended as a technical reference for an already disclosed vulnerability. It does not include a weaponized denial-of-service script.
| Item | Details |
|---|---|
| CVE | CVE-2026-18464 |
| Product | WP MAPS PRO |
| Affected versions | < 6.1.3 |
| Fixed version | 6.1.3 |
| Weakness | CWE-400 — Uncontrolled Resource Consumption |
| Attack requirement | Unauthenticated remote attacker |
| Severity | 7.5 (CVSS 3.1) |
| Published | 2026-08-09 |
| Finder | Mohammad Aghdasi |
| CNA / Coordinator | WPScan |
An AJAX action exposed to unauthenticated users lacks an appropriate capability check and does not sufficiently restrict the dispatched operation. An attacker can trigger uncontrolled recursion, causing excessive resource consumption and denial of service.
The security impact is limited to availability: successful exploitation can consume enough server resources to make the affected WordPress installation slow or unavailable. The published CVSS vector does not indicate confidentiality or integrity impact.
The affected code path combines two security problems:
That combination makes it possible to reach a recursive execution path that continuously consumes server resources.
An attacker meeting the access requirement above may cause:
The practical impact depends on the hosting environment, PHP limits, worker configuration, caching layer, and upstream rate limiting.
Affected: WP MAPS PRO < 6.1.3
Fixed: upgrade to 6.1.3 or later.
Administrators should update the plugin and avoid exposing outdated versions to untrusted users or traffic.
The vulnerable behavior is reachable through a WordPress AJAX action. The handler does not correctly enforce authorization and permits an unsafe operation to reach a recursive execution path.
No high-volume or automated denial-of-service proof of concept is included in this repository. Verification should be performed only in an isolated test environment with resource limits in place.
See docs/technical-analysis.md for a concise analysis of the issue.
7.5 (CVSS 3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The vulnerability was coordinated through WPScan, which is listed as the CNA/coordinator in the public CVE record.
The public record credits Mohammad Aghdasi as the finder.
Only dates confirmed by the public advisory are included here; no private disclosure timeline is claimed.
Upgrade the affected plugin to 6.1.3 or later.
Defense-in-depth measures can also reduce exposure:
These controls are supplementary and should not replace the vendor update.
The material in this repository is provided for security research, vulnerability management, and defensive testing. Test only systems you own or are explicitly authorized to assess.
Documentation in this repository is released under the MIT License.