Description

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-07T06:16:56.610Z",
  "pubdate": "2026-08-07T06:16:56.610Z",
  "executiveSummary": "A Denial of Service vulnerability exists within the WP Maps WordPress plugin affecting versions prior to 4.9.7. The vulnerability arises from a missing capability check and a lack of operation restriction within one of the plugin's AJAX actions. This flaw allows authenticated users with low-privileged Subscriber accounts to interact with exposed endpoint functionality. By exploiting this oversight, an attacker can trigger uncontrolled recursion that exhaustively consumes server resources, ultimately causing a Denial of Service condition against the hosting infrastructure. The risk implication is significant as it disrupts service availability without requiring elevated privileges beyond a standard Subscriber account, lowering the barrier to exploitation. Mitigation requires updating the WP Maps plugin to version 4.9.7 or later, where proper authorization checks and operational restrictions are presumably enforced.",
  "technicalDetails": "The vulnerability is rooted in inadequate input validation and access control enforcement within the AJAX action handling mechanism of the WP Maps plugin, specifically in versions prior to 4.9.7. The vulnerable component fails to perform a rigorous capability check to verify whether the requesting user possesses administrative or managerial privileges before processing the request. Furthermore, the implementation does not restrict the operations dispatched through this specific AJAX endpoint.\nThe attack flow begins when an authenticated user, constrained to a low-privileged Subscriber account, crafts an HTTP request targeting the exposed AJAX endpoint of the WP Maps plugin. Because the backend code lacks proper authentication and authorization gates for the dispatched action, the server processes the incoming parameters without validating the user's role.\nUpon receiving the request, the application logic enters an uncontrolled recursion loop due to unrestricted and unvalidated operation dispatching. This recursive execution rapidly consumes available CPU cycles, memory, and thread pools allocated to the PHP process and the underlying web server. As the recursion depth increases without a terminating base case or resource limitation, the server resources are completely exhausted. Consequently, the hosting environment becomes unresponsive, resulting in a localized Denial of Service affecting the entire WordPress instance.\nNetwork exposure is defined by the accessibility of the WordPress installation's AJAX handler (admin-ajax.php). Authentication requirements are minimal, necessitating only a valid Subscriber-level account session. No complex payload behavior or post-exploitation execution is observed, as the primary impact is purely destructive availability loss rather than remote code execution or data exfiltration."
}