WordPress Plugin Vulnerabilities

WP Maps Pro < 6.1.3 - Unauthenticated Denial of Service

Description

The plugin does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.

Proof of Concept

Affects Plugins

Plugin icon
wp-google-map-gold
Fixed in 6.1.3

References

CVE
CVE-2026-18464

Miscellaneous

Original Researcher
Mohammad Aghdasi
Submitter
Mohammad Aghdasi
Submitter website
https://github.com/ghoxtbyte
Verified
Yes
WPVDB ID
45d1c2c2-c5da-43b6-a982-5323fb8d9014

Timeline

Publicly Published
2026-08-03 (about 27 days ago)
Added
2026-08-03 (about 26 days ago)
Last Updated
2026-08-27 (about 2 days ago)

Other

Published
Title
Published
2025-09-25
Title
Download After Email 2.1.5 - 2.1.6 - Unauthorized Repeated Form Submissions
Published
2025-03-27
Title
Klarna Checkout for WooCommerce < 2.13.5 - DoS via Excessive Logging
Published
2026-08-14
Title
Kadence Starter Templates — Predesigned Website Templates < 2.3.4 - Unauthenticated Denial of Service
Published
2024-12-16
Title
Calculated Fields Form < 5.2.64 - Denial of Service
Published
2019-02-16
Title
PS PHPCaptcha < 1.2.0 -Denial of Service