The WP Maps WordPress plugin versions prior to 4.9.8 contain an access control weakness (CWE-284) where an AJAX action does not verify user capabilities or validate nonces. This flaw permits users with minimal privileges (Subscriber role) to create an unlimited number of options in the WordPress database. Because these options are loaded on every page request, this can lead to resource exhaustion or degraded performance. No CVSS score or official remediation details are provided, and no known exploits are reported in the wild.

Users with Subscriber privileges can exploit this vulnerability to create an unlimited number of database options, which are loaded on every page request. This can degrade website performance and potentially lead to denial of service conditions due to resource exhaustion. There is no indication of direct data compromise or privilege escalation from the provided information.

Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber user capabilities if possible and monitor for unusual database growth related to options. Avoid granting Subscriber roles to untrusted users.