WP Maps Plugin Uncontrolled Recursion DoS Vulnerability

Executive Summary

This vulnerability affects the WP Maps WordPress plugin versions before 4.9.7. It allows users with a Subscriber role to trigger uncontrolled recursion through an AJAX action that lacks proper capability checks. This recursion exhausts server resources, causing a Denial of Service (DoS).

Useful 0 Not Useful 0

Detection Guidance

Check if the WP Maps plugin version is below 4.9.7. Logs may show excessive server resource usage or repeated AJAX requests from Subscriber accounts. Monitor for unusual CPU or memory spikes.

Useful 0 Not Useful 0

Impact Analysis

If you are using the WP Maps plugin version prior to 4.9.7, an attacker with a Subscriber account could exploit this flaw to crash your website by consuming all server resources through recursion, making your site unavailable to legitimate users.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could indirectly impact compliance with standards like GDPR or HIPAA by causing service disruptions due to Denial of Service (DoS). Downtime may lead to unauthorized access risks or failure to meet availability requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update the WP Maps plugin to version 4.9.7 or later immediately. If updating is not possible, disable the plugin or restrict Subscriber roles from accessing AJAX actions until patched.

Useful 0 Not Useful 0