The WP Maps Pro plugin fails to check user capabilities for a particular AJAX action that is reachable by anyone on the site. Because the plugin then calls itself recursively without any safeguards, an unauthenticated user can invoke the action repeatedly, forcing the server to expend memory and processing time until it becomes unresponsive. The failure to limit recursion can lead to exhaustion of server resources, interrupting the WordPress application and any other services on the same host. This vulnerability does not expose or alter data; its primary impact is availability disruption.

WordPress sites running the WP Maps Pro plugin prior to version 6.1.3 are affected. The issue is present in all installations of the plugin where the vulnerable AJAX endpoint is enabled for public use.

The CVSS score is 7.5, indicating a high severity, and the lack of authentication and deterministic nature of the recursion suggest a high potential impact if exploited. The EPSS score is less than 1%, showing a very low but nonzero probability that attackers will exploit this weakness, yet the vulnerability remains a valid risk for any site unable to apply the latest patch. The vulnerability is not listed in CISA’s KEV catalog. An attacker simply needs to craft HTTP requests to the exposed AJAX URL to trigger the recursion; no additional credentials or privileges are required. The attack is straightforward, making the threat reasonable, especially for high‑traffic sites.