What’s Vulnerable › Vulnerabilities
CVE-2026-18464: WP Maps Pro < 6.1.3 - Unauthenticated Denial of Service
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-09 · updated 2026-08-26
- Weakness: CWE-400
Description
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.
Affected products
- WP MAPS PRO: before 6.1.3 — fixed in 6.1.3
How to fix
Upgrade to a fixed version: WP MAPS PRO 6.1.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-18464 or the next vulnerability affects your stack