CVE-2026-18466

Name of the Vulnerable Software and Affected Versions WP Maps versions prior to 4.9.8

Description An issue exists in an AJAX action where the software fails to perform a capability check and does not validate a nonce (a unique token used to prevent replay attacks). This allows users with a Subscriber account to create an unlimited number of options in the database, which are then loaded on every page request.

Recommendations Update WP Maps to version 4.9.8 or later.