The WP Maps Pro plugin fails to check user capabilities for a particular AJAX action that is reachable by anyone on the site. Because the plugin then calls itself recursively without any safeguards, an unauthenticated user can invoke the action repeatedly, forcing the server to expend memory and processing time until it becomes unresponsive. The failure to limit recursion can lead to exhaustion of server resources, interrupting the WordPress application and any other services on the same host. This vulnerability does not expose or alter data; its primary impact is availability disruption.

WordPress sites running the WP Maps Pro plugin prior to version 6.1.3 are affected. The issue is present in all installations of the plugin where the vulnerable AJAX endpoint is enabled for public use.

The CVSS score is not provided, but the lack of authentication and the deterministic nature of the recursion suggest a high potential impact if exploited. The EPSS score is unavailable, indicating that current exploitation evidence is limited, yet the vulnerability remains a valid risk for any site unable to apply the latest patch. The vulnerability is not listed in CISA’s KEV catalog. An attacker simply needs to craft HTTP requests to the exposed AJAX URL to trigger the recursion; no additional credentials or privileges are required. The attack is straightforward, making the threat reasonable, especially for high‑traffic sites.