CVE-2026-16265: 
WordPress vulnerability analysis and mitigation

CVE-2026-16265 is a Denial of Service vulnerability in the WP Maps WordPress plugin (also known as wp-google-map-plugin) affecting all versions before 4.9.7. The flaw allows authenticated users with only a Subscriber-level account to trigger uncontrolled recursion via an unprotected AJAX action, exhausting server resources. It was publicly disclosed on August 3, 2026, and assigned a CVSS v3.1 base score of 6.5 (Medium) (WPScan, GitHub Advisory). The vulnerability was discovered and reported by researcher Mohammad Aghdasi (WPScan).

The root cause is a missing capability check (CWE-400: Uncontrolled Resource Consumption) in one of the plugin's WordPress AJAX action handlers. Because the handler does not verify the requesting user's permissions or restrict the operation it dispatches, any authenticated subscriber can invoke it and trigger unbounded recursive processing. This uncontrolled recursion consumes CPU and memory until the server becomes unresponsive, constituting a resource exhaustion attack. The attack requires only a low-privilege authenticated session (Subscriber role) and no user interaction, making it straightforward to execute over the network (WPScan, GitHub Advisory).

Successful exploitation results in a complete loss of availability for the affected WordPress site, as the uncontrolled recursion exhausts server resources (CPU/memory), causing the web server to become unresponsive. There is no confidentiality or integrity impact — the vulnerability is limited to a Denial of Service condition. Any WordPress site running WP Maps before version 4.9.7 with at least one registered subscriber account is at risk, and repeated attacks could cause sustained outages (WPScan, GitHub Advisory).

CISA's SSVC assessment classifies exploitation status as "poc" (proof-of-concept), though WPScan has withheld the PoC details until August 25, 2026, to allow time for users to update (WPScan). There is no confirmed evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.14–0.24%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable per CISA's SSVC assessment, as it requires a valid Subscriber account (GitHub Advisory).

1. Obtain a Subscriber account: Register or obtain credentials for a low-privilege Subscriber account on a WordPress site running WP Maps before version 4.9.7.
2. Authenticate: Log in to the WordPress site and retrieve a valid authentication nonce or session cookie.
3. Identify the vulnerable AJAX endpoint: Locate the unprotected AJAX action registered by the WP Maps plugin (specific action name withheld pending PoC disclosure on August 25, 2026).
4. Send a crafted AJAX request: Submit an HTTP POST request to wp-admin/admin-ajax.php with the vulnerable action parameter and any required parameters that trigger the recursive operation.
5. Trigger resource exhaustion: The server-side handler enters uncontrolled recursion, consuming CPU and memory until the web server process crashes or becomes unresponsive, resulting in a Denial of Service for all site visitors (WPScan).

• Network: Repeated HTTP POST requests to wp-admin/admin-ajax.php from a single authenticated session, particularly targeting WP Maps-related action parameters; unusually high request rates from a low-privilege user account.
• Logs: WordPress or web server access logs showing a burst of AJAX requests from a Subscriber-level user; PHP error logs containing fatal errors related to maximum execution time exceeded or memory exhaustion (e.g., Fatal error: Maximum execution time of X seconds exceeded or Allowed memory size exhausted).
• Process: Web server worker processes (e.g., php-fpm, apache2) consuming 100% CPU or reaching memory limits; sudden spike in server load coinciding with AJAX requests.
• Availability: Sudden site unavailability or HTTP 500/503 errors correlating with the above log entries (WPScan).

The primary remediation is to upgrade the WP Maps WordPress plugin to version 4.9.7 or later, which introduces the necessary capability check on the affected AJAX action (WPScan). As interim workarounds, administrators should consider disabling open user registration to prevent unauthorized Subscriber accounts, implementing rate limiting on wp-admin/admin-ajax.php at the web server or WAF level, and restricting access to AJAX endpoints for low-privilege roles where possible (GitHub Advisory).