CVE-2026-18464 json
WP Maps Pro < 6.1.3 - Unauthenticated Denial of Service
published 2026-08-09 3 mo ago modified 2026-08-26 2 mo ago also EUVD-2026-54878
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 41%
- public exploits
- 0
- none known
Summary
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.
Patch / fix
- Unknown WP MAPS PRO 6.1.3
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- wpscan.com https://wpscan.com/vulnerability/45d1c2c2-c5da-43b6-a982-5323fb8d9014/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
- Unknown WP MAPS PRO
Classification
- Weakness
-
- CWE-400 Uncontrolled Resource Consumption
- Technology feeds
References
-
wpscan.com
/vulnerability/45d1c2c2-c5da-43b6-a982-5323fb8d9014/
exploit, vdb-entry, technical-description
Sources
- CVE List CVE-2026-18464
- NVD CVE-2026-18464
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.