CVE-2026-16265

MediumCVSS 6.5/10Last modified Aug 26, 2026

Description

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
Unknown	WP Maps	< 4.9.7

References

https://wpscan.com/vulnerability/5432f989-03d8-49d9-ac45-0d5a6a7bf499/

Timeline

Published: Aug 7, 2026
Last modified: Aug 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-162664.0Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey() function in util.js. An attacker CVE-2026-162678.1The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submi CVE-2026-162688.2The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied U CVE-2026-162694.8The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to byp CVE-2026-16278.1An attacker may exploit the use of outdated and weak MAC algorithms in the device’s SSH service to potentially compromise the integrity of t CVE-2026-162706.9Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex to a field. When so CVE-2026-162729.1Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module al CVE-2026-162734.6The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field or escape it when re CVE-2026-162742.7The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post CVE-2026-162755.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.4 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 th CVE-2026-162762.7The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store re CVE-2026-162776.5A stack-based buffer overflow was found in rpcbind's rpcinfo utility. When querying a remote rpcbind service with `rpcinfo -l`, address info