WP Maps, a popular WordPress plugin, contains an AJAX action that lacks proper capability verification and nonce validation. When a user with Subscriber privileges triggers this action, the plugin accepts any key/value pair and writes it into the options table without limits. Because the stored options are automatically loaded on every page request, an attacker can prepend a large quantity of autoloaded options, quickly consuming memory and potentially corrupting database performance. The flaw does not provide direct code execution, but it can degrade site availability and induce resource exhaustion.

This vulnerability affects installations of the WP Maps plugin older than version 4.9.8. WordPress sites that have not applied the published update are susceptible. The issue is confined to the plugin itself and does not impact the core WordPress framework or other plugins unless they rely on the contaminated options table.

The CVSS score of 5.4 reflects a moderate severity, and the EPSS score indicates a very low probability of exploitation in the wild. Because the flaw operates through a publicly accessible AJAX endpoint, any authenticated user with at least Subscriber access can exploit it, making the attack vector web-based. The vulnerability is not listed in the CISA KEV catalog, further suggesting the risk, while the lack of a nonce check limits the attacker’s control to the Subscriber role’s permissions. The most likely impact is a denial of service through database overload or application slowdown.