CVE-2026-84780: WP Go Maps DOS Vulnerability

CVE-2026-84780 Overview

CVE-2026-84780 is an unauthenticated denial of service vulnerability affecting the WP Go Maps WordPress plugin (formerly WP Google Maps) in versions 10.1.08 and earlier. The flaw is classified under [CWE-770: Allocation of Resources Without Limits or Throttling], allowing remote attackers to exhaust server resources without authentication. Successful exploitation degrades or interrupts availability of WordPress sites that use the plugin. The issue is reachable over the network with low attack complexity and no user interaction.

Critical Impact
Remote unauthenticated attackers can trigger resource exhaustion in WP Go Maps <= 10.1.08, causing availability loss for affected WordPress sites.

Affected Products

WP Go Maps (formerly WP Google Maps) WordPress plugin versions <= 10.1.08
WordPress installations with the vulnerable plugin activated
Sites exposing plugin endpoints to unauthenticated network traffic

Discovery Timeline

2026-09-02 - CVE-2026-84780 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84780

Vulnerability Analysis

The vulnerability resides in the WP Go Maps plugin's handling of unauthenticated requests to plugin endpoints. The plugin fails to enforce limits on resource-consuming operations, mapping to [CWE-770]. An attacker can repeatedly invoke the affected functionality to consume memory, CPU, or database connections until the WordPress instance becomes unresponsive. Because the endpoint requires no authentication, exploitation scales trivially with concurrent requests. The impact is limited to availability; the flaw does not expose data or allow code execution.

Root Cause

The root cause is the absence of throttling, rate limiting, or input-size validation on plugin-exposed request handlers. Without bounds on allocated resources per request, adversaries can force the application to allocate excessive resources. See the PatchStack WP Go Maps advisory for vendor-specific technical detail.

Attack Vector

Attack traffic originates from the network. An unauthenticated attacker sends crafted or high-volume HTTP requests to the plugin's exposed endpoints on a target WordPress site. No credentials, prior access, or user interaction are required. The result is denial of service against the site and, depending on hosting posture, adjacent workloads on the same host.

No verified proof-of-concept code is publicly available. Refer to the PatchStack advisory linked above for further technical detail.

Detection Methods for CVE-2026-84780

Indicators of Compromise

High volumes of unauthenticated HTTP requests targeting WP Go Maps REST or AJAX endpoints from a small set of source IPs
Sudden spikes in PHP worker utilization, database connection counts, or memory pressure on WordPress hosts
Increased 5xx error rates and elevated response latency on pages that embed WP Go Maps functionality

Detection Strategies

Monitor web server access logs for repetitive requests to WP Go Maps plugin paths from unauthenticated clients
Correlate application-tier resource exhaustion events with concurrent request volume against the plugin
Alert on anomalous request rates or payload sizes directed at WordPress /wp-json/ and /wp-admin/admin-ajax.php routes tied to the plugin

Monitoring Recommendations

Enable rate-based alerts at the web application firewall (WAF) or reverse proxy for plugin endpoints
Track WordPress plugin version inventory to identify hosts running WP Go Maps <= 10.1.08
Baseline normal request patterns for WP Go Maps and alert on deviations in volume, source diversity, and payload characteristics

How to Mitigate CVE-2026-84780

Immediate Actions Required

Upgrade WP Go Maps to a version later than 10.1.08 as soon as a fixed release is available from the vendor
Deploy WAF rules to rate-limit or block excessive requests to WP Go Maps endpoints from single sources
Restrict administrative and REST endpoints where feasible using IP allowlists or authentication requirements

Patch Information

Refer to the PatchStack advisory for WP Go Maps for fixed version guidance. Apply the vendor-provided update via the WordPress plugin manager or WP-CLI once the patched release is published.

Workarounds

Temporarily deactivate the WP Go Maps plugin on internet-facing WordPress sites if operational impact is acceptable
Enforce request rate limiting at the CDN, WAF, or reverse proxy tier for plugin URLs
Increase PHP-FPM worker isolation and set conservative memory and execution-time limits to contain resource exhaustion

bash

# Example: WP-CLI update once a fixed version is released
wp plugin update wp-google-maps

# Example: temporary deactivation
wp plugin deactivate wp-google-maps