The WP Maps plugin fails to enforce a capability check on an AJAX endpoint, and the endpoint contains an unbounded recursive operation. A user with only a Subscriber role can trigger this action, causing uncontrolled recursion that consumes server memory and CPU until the site becomes unresponsive. The weakness is a missing access control that allows an authenticated yet minimally privileged user to exhaust resources, resulting in a denial of service. The vulnerability is classified as CWE-400.

WordPress sites that have the WP Maps plugin installed with a version older than 4.9.7. The issue affects all installations where the default Subscriber role is assigned to users, as the plugin does not limit the AJAX action to privileged users. Site administrators should inventory all WordPress installations using WP Maps to confirm exposure.

Based on the description, the likely attack vector is an authenticated user with a Subscriber account initiating the vulnerable AJAX request from a standard browser or via script. No privilege escalation is required. The vulnerability can be exploited remotely by any such user with network access to the site, and the EPSS score is <1% and the CVSS score is 6.5. The impact is high: a single user can bring the site offline by exhausting resources. The CVE is not listed in CISA’s KEV catalog, but the lack of a role check and runaway recursion make it a straightforward high‑risk denial‑of‑service threat. No publicly known exploit code exists at this time.