CVE-2026-18464

HighCVSS 7.5/10Last modified Aug 26, 2026

Description

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Aug 9, 2026
Last modified: Aug 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-184656.5The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to una CVE-2026-184665.4The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing u CVE-2026-184679.8The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and includin CVE-2026-184688.1The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or CVE-2026-184698.1The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value, CVE-2026-18477.5Inserting certain large documents into a replica set could lead to replica set secondaries not being able to fetch the oplog from the primar CVE-2026-184707.5The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and CVE-2026-184739.1The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, lea CVE-2026-184748.6The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a CVE-2026-184774.4A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write a CVE-2026-184785.1Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into t CVE-2026-18487.5Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number o