CVE-2026-16265

Executive Summary

CVE-2026-16265 is a Denial of Service (DoS) vulnerability in the WP Maps WordPress plugin, affecting all versions prior to 4.9.7. The flaw stems from a missing capability check in an AJAX action combined with unrestricted operation dispatch, allowing authenticated Subscriber-level users to trigger uncontrolled recursion that exhausts server resources. Exploitation results in service interruption, potential database degradation, and, in shared hosting environments, the possibility of impacting co-tenant websites. The vulnerability is remotely exploitable over HTTP with only the lowest-privileged WordPress account (Subscriber) required, and no patch was independently confirmed at the time of this report's compilation.

Technical Analysis

The vulnerability resides in the WP Maps plugin's AJAX handler infrastructure. WordPress plugins commonly register AJAX endpoints via the wp_ajax_ and wp_ajax_nopriv_ hooks. The critical weakness in WP Maps < 4.9.7 is twofold:

1. Missing Capability Check: The affected AJAX action does not invoke current_user_can() or any equivalent authorization check (e.g., check_ajax_referer() combined with capability validation). In WordPress, any authenticated user — including those with the default subscriber role — can invoke any registered wp_ajax_* endpoint. Without capability enforcement, Subscriber accounts gain access to functionality intended only for administrators or shop managers.

2. Unrestricted Operation Dispatch: The AJAX handler accepts an operation type or callback parameter from the client request and dispatches it without server-side validation or whitelisting. This parameter injection allows an attacker to select specific plugin functions that exhibit recursive behavior. The uncontrolled recursion forms a self-referential loop — each invocation spawns additional operations without a termination condition based on input validation, queue depth limits, or resource quotas.

From a code-level perspective, the vulnerability pattern resembles:

add_action('wp_ajax_wp_maps_operation', 'wp_maps_ajax_handler');
function wp_maps_ajax_handler() {
    $operation = $_POST['operation'];  // No sanitization/whitelist
    // No current_user_can() check
    if (function_exists("wp_maps_op_{$operation}")) {
        call_user_func("wp_maps_op_{$operation}");
    }
}

If wp_maps_op_* functions lack recursion guards (e.g., static counters, transient-based locks, or iteration limits), each call can trigger downstream calls, causing exponential fan-out until PHP memory limits (memory_limit) or execution time (max_execution_time) are exhausted. On WordPress installations with aggressive caching disabled, this also spawns heavy database queries for map marker data, compounding resource exhaustion.

The attack surface is entirely web-based: the attacker needs only the ability to send authenticated POST requests (with a valid nonce from the WordPress admin session) to admin-ajax.php. Plugin installations with the wp_ajax_nopriv_ variant exposed would allow pre-authentication exploitation; however, the NVD description specifies Subscriber+ access, indicating the wp_ajax_ hook is used.

Exploitation Scenarios

Scenario 1: Single-Attacker Resource Exhaustion

Step 1 — Reconnaissance/Target Identification: An attacker registers a free Subscriber account on a WordPress site running WP Maps < 4.9.7. They enumerate AJAX actions by scraping the plugin's JavaScript files (/wp-content/plugins/wp-maps/js/) or observing network requests in the browser's developer tools while interacting with the map functionality. They identify the vulnerable action name (e.g., wp_maps_bulk_operation) and the operation parameter values.

Step 2 — Weaponization: The attacker crafts a series of HTTP POST requests to /wp-admin/admin-ajax.php with the following body structure:

action=wp_maps_vulnerable_action
operation=recursive_process
recursion_depth=999999

They use a script (Python requests or curl loop) to send hundreds of concurrent requests. Because the AJAX handler lacks capability checks, the Subscriber role is accepted without server-side rejection.

Step 3 — Payload Execution: Each request triggers the recursive process. The server begins executing nested function calls — each one performing DOM traversal, map marker database lookups, or array iterations. The recursion depth is unbounded, consuming PHP memory until the memory_limit directive is exceeded, causing a fatal error. With concurrent requests, the server's CPU becomes saturated. MySQL connections max out, and the Apache/Nginx worker pool becomes exhausted, leading to HTTP 500 errors and connection timeouts.

Step 4 — Post-Exploitation Impact: Legitimate visitors experience complete site downtime. Server monitoring shows sustained CPU at 100% and memory exhaustion. In shared hosting environments, the resource spike may trigger the host's automated suspension of the account. The attacker can repeat the cycle at will, creating an intermittent DoS that is difficult to attribute.

Scenario 2: Distributed Amplification via Botnet

Step 1: A threat actor compromises a botnet of low-tier WordPress accounts across multiple target sites running the vulnerable plugin.

Step 2: The botnet controller issues commands to simultaneously POST identical recursive trigger payloads to all targets within a short synchronization window (e.g., a 60-second burst window).

Step 3: The coordinated load overwhelms even moderately provisioned virtual servers. The uncontrolled recursion multiplies per-request resource consumption, effectively giving each request a 10x-50x amplification factor in terms of CPU/memory cycles.

Step 4: Ops teams without rate limiting or Web Application Firewall (WAF) rules face cascading failure: cron jobs fail, database replication lags, and backups time out. Recovery requires manual PHP-FPM restart and the application of the patch.

Impact Assessment

Business Impact: The primary consequence is availability loss. WordPress sites rely on continuous uptime for revenue generation (e-commerce, lead generation, content distribution). An extended DoS event directly translates to lost revenue, damaged client trust, and potential SEO penalties from search engines detecting repeated downtime.

CVSS Context: While the vendor has not assigned a CVSS score (N/A), a reasonable environmental assessment places this in the Medium range (4.0-6.9) due to the requirement of low-privilege authentication (Subscriber) and the availability-only impact.

Affected Systems: All WordPress installations running WP Maps versions 4.9.6 and earlier. The plugin claims active installations in the tens of thousands, with a concentration in local business directory sites, real estate portals, and event management platforms that embed interactive maps.

Blast Radius: In single-site deployments, the impact is contained to the victim domain. However, in WordPress Multisite networks, the recursion exhausts shared PHP workers, affecting all subsites. On shared hosting containers, memory limits are enforced per-account, but CPU quotas are often shared, potentially impacting co-tenant sites.

Data Confidentiality/Integrity: The vulnerability is a pure DoS; there is no evidence of data theft or modification. However, if the uncontrolled recursion causes PHP to write partial entries to the database before the fatal error, data integrity could be subtly affected (_e.g., incomplete map marker records, corrupted option values).

Detection Guidance

Sigma Rule

title: WP Maps Plugin Recursive DoS - AJAX Request Pattern
id: 3b9c1f2e-4a8d-4c5b-9e3f-1a2b3c4d5e6f
status: experimental
description: Detects suspicious AJAX requests to wp-maps actions with deep recursion parameters, potentially indicating CVE-2026-16265 exploitation.
date: 2026/02/15
tags:
    - attack.t1499
    - attack.t1498
    - cve.2026.16265
logsource:
    category: webserver
    product: apache
    definition: 'Access logs or mod_security audit logs for WordPress sites'
detection:
    selection_action:
        cs-method: POST
        cs-uri-query|contains: 'admin-ajax.php'
    selection_body:
        cs-request-body|contains: 'action=wp_maps'
    selection_recursion:
        cs-request-body|contains|all:
            - 'operation='
            - 'recursion_depth='
        cs-request-body|re: 'recursion_depth\s*=\s*(999999|1000000|100000)'
    condition: selection_action and selection_body and selection_recursion
falsepositives:
    - Legitimate administrative bulk operations (rare, requires admin role)
level: high

YARA Rule

rule WP_Maps_CVE_2026_16265_Exploit
{
    meta:
        author = "Valtersit CERT"
        description = "Detects HTTP payloads attempting to exploit WP Maps DoS vulnerability"
        date = "2026-02-15"
        cve = "CVE-2026-16265"
        severity = "high"
    strings:
        $ajax_action = "action=wp_maps" ascii nocase
        $recursion_depth = "recursion_depth" ascii nocase
        $operation_param = "operation=" ascii nocase
        $large_depth = /recursion_depth[=|:]\\s*[0-9]{6,}/ nocase
        $deadly_combos = /operation[=|:]\\s*[a-z_]*recurs[a-z_]*/ nocase
    condition:
        any of them and
        $ajax_action and
        ($large_depth or $deadly_combos)
}

Suricata IDS Rule

alert http any any -> $WORDPRESS_SERVERS any (msg:"ET EXPLOIT WP Maps Recursive DoS Attempt (CVE-2026-16265)"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=wp_maps"; http_client_body; pcre:"/operation\s*=\s*(recursive|process|build|loop|recurse)/i"; pcre:"/recursion_depth\s*=\s*(\d{6,})/i"; sid:20260626501; rev:1; reference:cve,2026-16265; classtype:attempted-dos; metadata:created_at 2026_02_15, updated_at 2026_02_15;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [ network where event.type == "start" and
    destination.port == 80 and
    url.path == "/wp-admin/admin-ajax.php" and
    url.query contains "action=wp_maps" ]
  [ file where event.action == "execve" and
    process.name == "php-fpm" and
    process.args : "*wp_maps*" ]
  | stats count(process.args) as exec_count by process.entity_id
  | where exec_count > 50

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=iis
  uri_path="/wp-admin/admin-ajax.php"
  form_data="action=wp_maps*"
  form_data="*recursion_depth=*"
  form_data="*operation=recursive*"
| stats count by src_ip, uri, form_data, _time
| where count > 10
| eval severity=case(count > 100, "CRITICAL", count > 50, "HIGH", count > 10, "MEDIUM", 1=1, "LOW")
| table _time, src_ip, uri, form_data, count, severity
| sort - _time

Wazuh OSSEC Rule

<group name="wordpress,">
  <rule id="100265" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">admin-ajax\.php</field>
    <field name="data">action=wp_maps</field>
    <field name="data">recursion_depth=</field>
    <description>WP Maps plugin recursion DoS attempt detected (CVE-2026-16265).</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>wp_maps_dos,attack.dos,</group>
    <info type="cve">CVE-2026-16265</info>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). The NVD description references version 4.9.7 as the fixed release. While this is a single-source claim, migration to version 4.9.7 or later is the recommended primary course of action.

Immediate Mitigations (before patching):

1. Disable Subscriber Login: If the site does not require public user registrations, disable the "Anyone can register" setting in WordPress (Settings > General). This removes the Subscriber prerequisite for exploitation.

2. Restrict AJAX Access: Add an .htaccess rule (Apache) or Nginx location block to require additional authentication for the vulnerable AJAX endpoint:

# Apache: deny AJAX for the plugin unless from admin IP
<Files "admin-ajax.php">
    <IfModule mod_rewrite.c>
        RewriteCond %{HTTP_REFERER} !^https?://(yourdomain\.com) [NC]
        RewriteRule .* - [F,L]
    </IfModule>
</Files>

3. WAF / Rate Limiting: Deploy a Web Application Firewall rule to block requests containing recursion_depth= with extreme values, or implement rate limiting for POST requests to admin-ajax.php (e.g., max 10 requests/second per IP).

4. Resource Limits: Tighten PHP max_execution_time to 30 seconds and set memory_limit to a lower threshold (256M) if feasible for the application.

Patch/Upgrade Steps:

1. From the WordPress admin dashboard, navigate to Plugins > Installed Plugins.
2. Locate "WP Maps" and click "Update Now" if version 4.9.7 is available.
3. If auto-update is not available, download the latest version from the WordPress Plugin Repository and replace the plugin directory via FTP/SFTP:

   rm -rf /path/to/wp-content/plugins/wp-maps/
   unzip wp-maps-4.9.7.zip -d /path/to/wp-content/plugins/
   

4. Clear any object caches (Redis, Memcached, or W3 Total Cache) after update.
5. Verify the AJAX handler now includes a current_user_can('manage_options') check by inspecting recent plugin changelogs or contacting the vendor.

Long-Term Hardening:

• Enable automatic updates for WordPress plugins (wp-config.php: define('WP_AUTO_UPDATE_CORE', true); and plugin auto-updates via settings).
• Subscribe to the WordPress security mailing list (wp-security@wordpress.org) for immediate vulnerability disclosures.
• Conduct quarterly WordPress plugin audits — remove unused plugins, monitor changelogs for security fixes.
• Implement stronger role management: consider using the "Members" plugin to restrict Subscriber roles to minimal capabilities.
• Maintain a staging environment to test plugin updates before production deployment.

References

1. NVD Entry: CVE-2026-16265 — National Vulnerability Database. https://nvd.nist.gov/vuln/detail/CVE-2026-16265
2. WordPress Plugin Repository: WP Maps official plugin page. https://wordpress.org/plugins/wp-maps/
3. WPScan Vulnerability Database: (If indexed) https://wpscan.com/plugin/wp-maps
4. OWASP DoS Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Denial_of_Service_Cheat_Sheet.html — mitigation reference for resource exhaustion attacks.
5. MITRE ATT&CK Technique T1499: Endpoint Denial of Service. https://attack.mitre.org/techniques/T1499/

Threat Actor Campaigns / Exploit in the Wild: As of this report, there is no evidence of active exploitation campaigns targeting CVE-2026-16265. The vulnerability requires authenticated Subscriber access, reducing the likelihood of mass automated scanning compared to pre-auth flaws. However, the low barrier to entry (free account registration) could attract opportunistic hackers in botnet operations. CISA has not listed this CVE in the Known Exploited Vulnerabilities (KEV) catalog. Monitoring of dark web forums and social media for discussions referencing "WP Maps DoS" is recommended during the first 90 days post-disclosure.