CVE-2026-16265

The CVE concerns the WP Maps WordPress plugin, specifically versions before 4.9.7. The issue is a missing capability check in one of the plugin’s AJAX actions and a lack of restriction on the dispatched operation, which can allow a user with a Subscriber account to trigger uncontrolled recursion,...