CVE-2026-16265: WP Maps < 4.9.7 - Subscriber+ Denial of Service
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/wp-mapsto a version that resolves this vulnerability.Fixed in 4.9.7 - Compensating control
Restrict access to the affected WordPress plugin’s AJAX endpoints to authenticated users with appropriate capabilities, e.g., at the application level or via a WAF/ACL rule that blocks Subscriber-level requests to those actions.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16265?
CVE-2026-16265 has a risk score of 35, indicating a moderate severity level.
How do I fix CVE-2026-16265?
To fix CVE-2026-16265, update the WP Maps plugin to version 4.9.7 or later.
What impact does CVE-2026-16265 have on my website?
CVE-2026-16265 can allow users with a Subscriber account to cause a Denial of Service by exhausting server resources.
Who is affected by CVE-2026-16265?
CVE-2026-16265 affects websites using WP Maps plugin versions prior to 4.9.7.
What action does CVE-2026-16265 exploit?
CVE-2026-16265 exploits an AJAX action that does not perform a capability check, allowing unauthorized operations.