Description

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-09T06:18:34.450Z",
  "pubdate": "2026-08-09T06:18:34.450Z",
  "executiveSummary": "An unauthenticated Denial of Service (DoS) vulnerability exists in the WP MAPS PRO WordPress plugin prior to version 6.1.3.\nThe security flaw stems from an absent capability check within an AJAX action endpoint that remains publicly accessible to unauthenticated actors.\nWithout proper request validation or parameter restriction, remote attackers can dispatch malicious calls designed to trigger uncontrolled recursion.\nThe primary operational impact is severe resource exhaustion, leading to server degradation or complete service unavailability for legitimate users.\nThe attack vector requires network access to the target WordPress installation and zero prior authentication or elevated privileges, lowering the complexity threshold for potential exploitation.\nRisk implications include operational disruption and potential cascading failures on hosting infrastructure due to excessive CPU and memory consumption during the recursive execution loop.",
  "technicalDetails": "The root cause of the vulnerability lies in inadequate access control implementation and insufficient input validation within the AJAX dispatch handling of the WP MAPS PRO WordPress plugin.\nSpecifically, the plugin exposes an AJAX action handler that fails to verify user roles or capabilities using standard WordPress authorization functions such as current_user_can().\nFurthermore, the endpoint does not enforce constraints or sanitization on the dispatched operations, allowing external inputs to manipulate internal execution flow.\nAffected versions include all iterations of the WP MAPS PRO WordPress plugin prior to version 6.1.3.\nBecause the AJAX action is registered improperly, unauthenticated network attackers can interact directly with the WordPress administration-ajax endpoint without possessing any session tokens, authentication cookies, or administrative privileges.\nThe step-by-step attack flow proceeds as follows: First, the unauthenticated attacker crafts an HTTP request targeting the exposed AJAX endpoint associated with the vulnerable plugin. Second, the request bypasses authorization checks due to the missing capability validation. Third, the internal handler processes the input and initiates an uncontrolled recursive routine without a proper termination condition or depth limitation. Fourth, the recursive function continuously consumes call stack memory and CPU cycles until server resource limits are reached.\nThe post-exploitation impact is strictly focused on availability, resulting in resource exhaustion, HTTP 500 internal server errors, database connection pool depletion, and potential kernel-level out-of-memory (OOM) killer invocations that terminate core web server processes."
}