WP Maps < 4.9.7 – Subscriber+ Denial of Service | CVE 2026-16265

Description

The plugin does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.

Proof of Concept

## Proof of Concept

Prerequisites: WP Maps active with a Map created and a front-end page rendering the map script; a Subscriber account.

1. Log in as the Subscriber and open a front-end page that renders the map. Read the nonce from the page HTML (the localized `wpgmp_local.nonce` value).

2. Send a request that names the AJAX handler itself as the operation, with the Subscriber session cookies and the harvested nonce:

```
curl -s -X POST "https://victim.example/wp-admin/admin-ajax.php" \
  -b subscriber-cookies.txt \
  -d "action=wpgmp_ajax_call&nonce=<harvested nonce>&operation=wpgmp_ajax_call"
```

The handler dispatches itself with no base case, recursing until the PHP memory limit is exhausted (a single request terminates with an out-of-memory fatal after a few seconds).

3. Issuing ~100-200 such requests concurrently saturates the PHP worker pool and server memory, making the site unresponsive for normal visitors for the duration of the attack.

Controls: an unauthenticated request returns HTTP 400 (no `nopriv` handler, so the floor is a logged-in Subscriber); a Subscriber with an invalid nonce returns HTTP 403. The same handler dispatches any attacker-named method (an undefined operation returns an undefined-method fatal), confirming the unrestricted dynamic dispatch.