Description

The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-19T06:17:37.697Z",
  "pubdate": "2026-08-19T06:17:37.697Z",
  "executiveSummary": "An arbitrary option creation vulnerability exists in the WP Maps WordPress plugin prior to version 4.9.8. The vulnerability stems from a lack of proper capability checks and cryptographic nonce validation within a specific AJAX action handler.\nAn authenticated attacker with low-privilege Subscriber access can leverage this flaw to programmatically inject an unlimited number of arbitrary key-value pairs directly into the WordPress options database table.\nBecause WordPress routinely autoloads a significant subset of database options during every page initialization, the injection of massive or uncontrolled options severely degrades system performance and introduces a persistent Denial of Service (DoS) vector.\nThe risk implications are critical for availability, as the accumulation of redundant database entries bloats memory consumption and database query execution times across the entire web application.\nExploitation requires network access to the target WordPress instance and a valid low-privilege user session (Subscriber role) to interact with the exposed AJAX endpoint, requiring no complex user interaction beyond executing HTTP requests.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure implementation of an AJAX action handler within the WP Maps plugin codebase prior to version 4.9.8. Specifically, the affected AJAX endpoint fails to execute requisite authorization routines, omitting both current_user_can capability checks and cryptographic nonce verification (CSRF tokens).\nBecause the endpoint inadequately restricts access, any authenticated user possessing the lowest default WordPress privilege level—specifically a Subscriber account—can successfully invoke the vulnerable AJAX action.\nUpon receiving a crafted HTTP request targeting the exposed AJAX handler, the backend processing logic blindly accepts parameters supplied by the client and interfaces directly with the WordPress database abstraction layer, typically utilizing functions such as add_option() or update_option() without sanitizing or limiting the scope of the input keys.\nThe attack flow proceeds as follows: First, the malicious actor authenticates to the WordPress site as a Subscriber to acquire a valid session cookie. Second, the attacker formulates an HTTP POST request directed at the WordPress admin-ajax.php endpoint, specifying the vulnerable action parameter associated with the WP Maps plugin. Third, the request payload includes custom option names and associated malicious or junk data values.\nBecause the vulnerable function lacks access controls and input validation, the application writes the arbitrary keys directly to the wp_options database table.\nIn the WordPress architecture, options designated for autoloading are fetched into memory during the bootstrap phase of every page request. By flooding the wp_options table with a virtually unlimited number of newly created options—particularly if configured or forced to autoload—the attacker induces catastrophic database bloat.\nThe post-exploitation impact manifests as severe resource exhaustion. Every subsequent frontend or backend HTTP request forces the database server to parse and transmit the bloated set of autoloaded options, rapidly consuming available memory (PHP memory_limit exhaustion), spiking CPU utilization, and ultimately rendering the WordPress application entirely unresponsive or inaccessible to legitimate users, thereby achieving a persistent application-layer Denial of Service."
}