Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include and execute arbitrary existing local PHP files on the server.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-18465 The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and do… https://www.cve.org/CVERecord?id=CVE-2026-18465
Post summary
The entry discloses a missing capability check in an AJAX action of WP MAPS PRO v<6.1.3 that could allow unauthenticated access; no PoC, exploit, or patch information is included.
🚨*CVE* CVE-2026-18465 The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and do… https://www.cve.org/CVERecord?id=CVE-2026-18465 ----- Traducción: CVE-2026-18465 El … http://infoflow.cloud`
Post summary
The post announces CVE-2026-18465, noting that WP MAPS PRO before 6.1.3 lacks a capability check in an AJAX action, allowing unauthenticated attackers, but provides no PoC, exploit details, or evidence of active exploitation.