CVE-2026-18466
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The WP Maps WordPress plugin before 4.9.8 does not perform a capability check nor validate a nonce in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each loaded on every page request.
Risk Assessment
An attacker can fill the database, leading to site slowdown and potential resource exhaustion.
Recommendation
Update the WP Maps plugin to version 4.9.8 or later, which includes security fixes.
Original NVD description (English source)
The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request.