CVE-2026-18464: WP MAPS PRO WordPress DoS Vulnerability

CVE-2026-18464 Overview

CVE-2026-18464 affects the WP MAPS PRO WordPress plugin in versions prior to 6.1.3. The plugin exposes an AJAX action to unauthenticated users without performing a capability check or restricting the dispatched operation. Attackers can trigger uncontrolled recursion through this endpoint, exhausting server resources and causing a Denial of Service. The flaw is categorized under [CWE-400] (Uncontrolled Resource Consumption).

Critical Impact
Unauthenticated remote attackers can exhaust server CPU and memory through a single AJAX request, taking affected WordPress sites offline without credentials or user interaction.

Affected Products

WP MAPS PRO WordPress plugin, all versions before 6.1.3
WordPress sites running the vulnerable plugin with AJAX endpoints reachable from the internet
Shared hosting environments where a single site outage can affect co-tenants

Discovery Timeline

2026-08-09 - CVE-2026-18464 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-18464

Vulnerability Analysis

The WP MAPS PRO plugin registers an AJAX action through the WordPress wp_ajax_ and wp_ajax_nopriv_ hooks. Registering the handler under the nopriv variant makes it reachable by unauthenticated visitors at /wp-admin/admin-ajax.php. The handler does not call current_user_can() or validate a nonce before executing its work.

The dispatched operation accepts attacker-controlled input that influences a recursive routine. Because the recursion depth and branching are not bounded, an attacker can craft parameters that cause the function to call itself repeatedly. Each recursive call consumes stack space, memory, and CPU cycles until the PHP worker process is exhausted or the request times out.

Repeated requests tie up all available PHP-FPM workers. Once the worker pool is saturated, the web server cannot serve legitimate traffic, producing a full site outage.

Root Cause

Two defects combine to produce the impact. First, the AJAX action lacks authorization checks, violating the principle of least privilege. Second, the operation dispatched by the handler does not enforce an upper bound on recursion depth or input size, satisfying the conditions for [CWE-400] uncontrolled resource consumption.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker sends an HTTP POST request to admin-ajax.php specifying the vulnerable action parameter along with crafted input values that maximize recursion. No authentication, session, or user interaction is required. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-18464

Indicators of Compromise

Repeated POST requests to /wp-admin/admin-ajax.php from a small set of source IPs targeting a WP MAPS PRO action parameter
PHP-FPM or Apache worker saturation coinciding with elevated 5xx response rates
Sustained CPU spikes on the PHP process without a matching increase in legitimate traffic
PHP error log entries referencing maximum execution time exceeded or memory exhaustion in plugin files

Detection Strategies

Alert on unauthenticated requests to admin-ajax.php where the action parameter matches WP MAPS PRO handlers and the request rate exceeds a baseline threshold
Correlate web server access logs with application performance metrics to surface low-volume request floods that produce disproportionate resource usage
Track HTTP request duration percentiles for admin-ajax.php and flag sustained increases in p95 and p99 latency

Monitoring Recommendations

Instrument WordPress with request logging that captures the action parameter, source IP, and response time for every AJAX call
Forward web server, PHP-FPM, and WordPress logs to a centralized platform for correlation and long-term retention
Monitor PHP worker pool utilization and configure alerts when saturation exceeds operational thresholds

How to Mitigate CVE-2026-18464

Immediate Actions Required

Update the WP MAPS PRO plugin to version 6.1.3 or later on all WordPress sites
If patching is delayed, deactivate the plugin until the update is applied
Deploy a Web Application Firewall (WAF) rule that blocks unauthenticated POST requests to the vulnerable AJAX action
Rate-limit requests to /wp-admin/admin-ajax.php at the reverse proxy or WAF layer

Patch Information

The vendor addressed the issue in WP MAPS PRO version 6.1.3 by adding authorization checks to the affected AJAX action and constraining the dispatched operation. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Restrict access to /wp-admin/admin-ajax.php through IP allowlisting where administrative access is limited to known networks
Lower the PHP max_execution_time and memory_limit values to reduce the impact of a single abusive request
Configure PHP-FPM pm.max_children and per-IP connection limits to prevent a single client from exhausting the worker pool
Remove the plugin entirely if map functionality is not required

bash

# Example NGINX rate limiting for admin-ajax.php
limit_req_zone $binary_remote_addr zone=ajax_limit:10m rate=10r/m;

location = /wp-admin/admin-ajax.php {
    limit_req zone=ajax_limit burst=5 nodelay;
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}