CVE-2026-18464: 
WordPress vulnerability analysis and mitigation

CVE-2026-18464 is an unauthenticated Denial of Service vulnerability in the WP MAPS PRO WordPress plugin (also known as wp-google-map-gold) affecting all versions before 6.1.3. The flaw allows unauthenticated remote attackers to exhaust server resources by triggering uncontrolled recursion through an unsecured AJAX action. It was publicly disclosed on August 3, 2026, and assigned by WPScan; the original researcher is Mohammad Aghdasi (WPScan). The CVSS category is estimated as Medium, with an EPSS score of 0.0 (GitHub Advisory).

The root cause is a missing capability check (CWE-400: Uncontrolled Resource Consumption) in one of the plugin's AJAX action handlers, which is registered and accessible to unauthenticated users. Because the action does not restrict the operations it dispatches, an attacker can craft a request that causes the server-side code to enter uncontrolled recursion, consuming PHP execution stack and server memory until resources are exhausted. No authentication or special privileges are required — the vulnerable endpoint is reachable by any network user (WPScan, GitHub Advisory). A proof-of-concept is scheduled for public release on September 11, 2026, to allow time for users to update (WPScan).

Successful exploitation causes a Denial of Service by exhausting server resources (CPU, memory, or PHP process stack), which can crash or render the affected WordPress site unavailable to legitimate users. Because the attack requires no authentication, any internet-facing WordPress installation running a vulnerable version of WP MAPS PRO is at risk. There is no evidence of confidentiality or integrity impact; the primary consequence is availability loss (WPScan, GitHub Advisory).

There is currently no public proof-of-concept exploit available; WPScan has withheld PoC details until September 11, 2026. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (WPScan, GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the WP MAPS PRO (wp-google-map-gold) plugin in a version prior to 6.1.3 using tools such as WPScan, Shodan, or by inspecting publicly accessible plugin asset paths (e.g., /wp-content/plugins/wp-google-map-gold/).
2. Identify the vulnerable AJAX endpoint: Locate the unauthenticated AJAX action registered by the plugin. WordPress AJAX actions for unauthenticated users are typically accessible via POST /wp-admin/admin-ajax.php with an action parameter corresponding to the vulnerable handler.
3. Craft the malicious request: Send a crafted HTTP POST request to admin-ajax.php with the specific action value that triggers the uncontrolled recursion, without supplying any authentication credentials or nonce.
4. Trigger resource exhaustion: Repeat or flood the request to sustain the recursive execution, exhausting PHP stack memory or server CPU/RAM until the web server process crashes or becomes unresponsive, resulting in a Denial of Service for legitimate users (WPScan).

• Network: High volume of HTTP POST requests to /wp-admin/admin-ajax.php from a single or small set of IP addresses, particularly with a specific action parameter value associated with the WP MAPS PRO plugin.
• Logs: Web server access logs showing repeated unauthenticated POST requests to admin-ajax.php; PHP error logs showing fatal errors such as Maximum function nesting level reached or Allowed memory size exhausted originating from WP MAPS PRO plugin files.
• Process: Elevated PHP-FPM or Apache/Nginx worker CPU and memory usage; web server worker processes crashing or restarting repeatedly during the attack window.

The vendor (flippercode) has released version 6.1.3 of the WP MAPS PRO plugin, which addresses this vulnerability by implementing proper capability checks on the affected AJAX action. WordPress site administrators should update the plugin to version 6.1.3 or later immediately. If immediate patching is not possible, consider temporarily deactivating the plugin or restricting access to wp-admin/admin-ajax.php via firewall or WAF rules until the update can be applied (WPScan, GitHub Advisory).