Unauthenticated Database Option Creation in WP Maps WordPress Plugin

Executive Summary

This vulnerability affects the WP Maps WordPress plugin versions before 4.9.8. It allows users with a Subscriber role to create an unlimited number of options in the WordPress database through an AJAX action that lacks proper capability checks and nonce validation. Each created option is loaded on every page request, which can impact site performance.

Useful 0 Not Useful 0

Detection Guidance

Check if the WP Maps plugin version is below 4.9.8 by inspecting the plugin files or WordPress admin panel. Look for unusual database entries created by Subscriber accounts, particularly in the wp_options table. Monitor server logs for excessive AJAX requests from Subscriber roles.

Useful 0 Not Useful 0

Impact Analysis

An attacker with a Subscriber account could exploit this to create excessive database entries, leading to increased server load, slower page loads, and potential denial-of-service conditions. It may also allow unauthorized modifications to plugin settings.

Useful 0 Not Useful 0

Mitigation Strategies

Update the WP Maps plugin to version 4.9.8 or later immediately. If updating is not possible, consider temporarily disabling the plugin or restricting Subscriber role capabilities to prevent unauthorized database modifications.

Useful 0 Not Useful 0