Description

Unauthenticated Denial of Service Attack in WP Go Maps <= 10.1.08 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-02T12:17:15.420Z",
  "pubdate": "2026-09-02T12:17:15.420Z",
  "executiveSummary": "The WP Go Maps plugin, in versions 10.1.08 and earlier, is susceptible to an Unauthenticated Denial of Service (DoS) vulnerability.\nThis vulnerability allows remote, unauthenticated attackers to disrupt the availability of the WordPress site by exhausting server resources.\nThe flaw resides in the handling of certain requests processed by the plugin, which, when crafted maliciously, can trigger resource-intensive operations or process crashes.\nThe impact is significant, as it enables an adversary to render the WP Go Maps functionality or the entire WordPress site unresponsive, potentially impacting business operations and user experience.\nNo authentication or specific privileges are required to exploit this vulnerability, making it accessible to any remote attacker with network access to the target web server.\nSuccessful exploitation leads to service degradation or complete downtime, requiring immediate remediation efforts by site administrators.",
  "technicalDetails": "The vulnerability originates from inadequate input validation or improper handling of specific request parameters within the WP Go Maps plugin components.\nThe plugin processes incoming requests that, under normal circumstances, should interact with map data or plugin configurations. However, the affected versions fail to correctly sanitize or restrict these requests when they originate from unauthenticated sources.\nAn unauthenticated attacker can exploit this by sending a specially crafted request to an exposed endpoint handled by WP Go Maps. This request is designed to trigger a computationally expensive operation or an unhandled exception within the plugin's code path.\nThe attack flow proceeds as follows: 1) The attacker identifies the publicly accessible endpoint used by WP Go Maps for processing map-related actions. 2) The attacker crafts a request containing malicious or malformed parameters that deviate from the expected input schema. 3) The plugin processes the request and executes a vulnerable code segment that lacks proper resource management or error handling. 4) The resulting operation causes high CPU usage, excessive memory consumption, or triggers a PHP fatal error, leading to a service crash.\nThe vulnerable components are likely internal PHP scripts responsible for processing user input related to map rendering or configuration, which execute synchronously within the context of the web server (e.g., Apache/Nginx via PHP-FPM).\nBecause the vulnerability is reachable without authentication, it possesses a high network exposure, allowing any remote user to initiate the attack. The lack of privilege requirements makes this a low-barrier-to-entry exploit.\nPost-exploitation impact manifests as a Denial of Service, where the server may stop responding to legitimate requests for the affected endpoint or, in severe cases, exhaust server-wide resources, causing the entire web server to become unresponsive to all traffic.\nThe vulnerability affects WP Go Maps versions up to and including 10.1.08. No mitigation is provided by the application logic to restrict access to these internal processing functions to authorized users or to validate the resource intensity of the requests adequately."
}