The WP MAPS PRO plugin for WordPress prior to version 6.1.3 does not perform a capability check on one of its AJAX actions, which is accessible without authentication. This missing restriction enables unauthenticated attackers to invoke an operation that causes uncontrolled recursion, leading to resource exhaustion on the server and resulting in a Denial of Service condition. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption).

An attacker can cause a Denial of Service by exhausting server resources through repeated invocation of the vulnerable AJAX action without authentication. There is no impact on confidentiality or integrity reported. The CVSS v3.1 base score is 7.5 (High), reflecting the ease of exploitation (network vector, no privileges required, no user interaction) and the high impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable AJAX action by implementing capability checks or other access controls to prevent unauthenticated access and mitigate resource exhaustion.