Excessive Database Option Creation in WP Maps Plugin from WordPress
CVE-2026-18466
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-18466?
The WP Maps plugin for WordPress, before version 4.9.8, is susceptible to an improper capability check that does not validate user permissions during certain AJAX actions. This flaw permits users with a Subscriber account to create an unlimited number of options within the database, leading to potential performance degradation as these options are loaded with every page request. Consequently, this issue underscores the importance of validating user roles and securing AJAX actions in WordPress plugins.
Affected Version(s)
WP Maps 0 < 4.9.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.