CVE-2026-18464— WP Maps Pro < 6.1.3 - Unauthenticated Denial of Service
Possible ATT&CK Techniques 1AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | WP MAPS PRO | < 6.1.3 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-18464
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WP Maps Pro < 6.1.3 - Unauthenticated Denial of Service
Source: CVE Program / CVE List V5
Vulnerability Description
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | WP MAPS PRO | 0 ~ 6.1.3 | - |
II. Public POCs for CVE-2026-18464
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-18464
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-18464 (1)
- 🔗 WP Maps Pro < 6.1.3 – Unauthenticated Denial of Service | CVE 2026-18464 | Plugin Vulnerabilitiesexploitvdb-entrytechnical-description
Same Patch Batch · Unknown · 2026-08-09 · 17 CVEs total
| CVE-2026-15038 | InfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite | |
| CVE-2026-16032 | LWS Optimize < 4.1.2 - Unauthenticated Stored XSS via Real User Monitoring | |
| CVE-2026-18473 | WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' Parameter | |
| CVE-2026-18603 | Cancel Order & Request Woocommerce < 1.3.4.34 - Unauthenticated Order Content Disclosure v | |
| CVE-2026-18465 | WP Maps Pro < 6.1.3 - Unauthenticated Local File Inclusion | |
| CVE-2026-17017 | CubeWP Framework < 1.1.31 - Subscriber+ SQL Injection via cubewp_remove_relation | |
| CVE-2026-18357 | WPC Order Tip for WooCommerce < 3.3.1 - Unauthenticated Order Data Disclosure | |
| CVE-2026-18037 | Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publicati | |
| CVE-2026-18032 | WP Data Access < 5.5.79 - Unauthenticated Sensitive Data Disclosure via Autocomplete Colum | |
| CVE-2026-17044 | WordPress File Upload < 5.1.8 - Unauthenticated SQL Injection via uniqueuploadid | |
| CVE-2026-17014 | WP Photo Album Plus < 9.2.07.002 - Unauthenticated Export ZIP File Deletion via delexportz | |
| CVE-2026-16965 | Solace Extra < 1.6.1 - Subscriber+ Post Meta Update via solace_update_sitebuilder_status | |
| CVE-2026-16988 | GeoDirectory < 2.8.169 - Unauthenticated Pending/Draft Listing Disclosure via markers REST | |
| CVE-2026-16992 | Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publicati | |
| CVE-2026-16957 | Slim SEO < 4.9.11 - Contributor+ Arbitrary Post Meta Disclosure | |
| CVE-2026-17011 | Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection |
IV. Related Vulnerabilities
Same vendor: Unknown
- CVE-2026-19075
All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side R - CVE-2026-19074
Advanced Classifieds & Directory Pro < 3.4.3 - Unauthenticat - CVE-2026-19089
Product Input Fields for WooCommerce < 2.0.2 - Unauthenticat - CVE-2026-19077
Copy & Delete Posts < 1.5.5 - Authenticated Arbitrary Post D - CVE-2026-15047
s2Member < 260805 - Contributor+ Stored XSS via Shortcode
V. Comments for CVE-2026-18464
No comments yet