CVE-2026-18466 — WP Maps < 4.9.8 - Subscriber+ Unlimited Autoloaded Option Creation
The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to cre…
Published: 2026-08-19 · CVSS: 5.4 · CVSS 3.1
The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7