The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Wordpress |
|
| Wp Maps |
|
No data.
No data.
References
History
Wed, 19 Aug 2026 17:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-284 | |
| Metrics |
cvssV3_1
|
Wed, 19 Aug 2026 12:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Wordpress
Wordpress wordpress Wp Maps Wp Maps wp Maps |
|
| Vendors & Products |
Wordpress
Wordpress wordpress Wp Maps Wp Maps wp Maps |
Wed, 19 Aug 2026 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request. | |
| Title | WP Maps < 4.9.8 - Subscriber+ Unlimited Autoloaded Option Creation | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: WPScan
Published: 2026-08-19T06:00:19.430Z
Updated: 2026-08-19T16:18:01.277Z
Reserved: 2026-07-31T08:01:35.190Z
Link: CVE-2026-18466
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-19T06:17:37.697
Modified: 2026-08-19T17:18:36.800
Link: CVE-2026-18466
Redhat
No data.