WP Maps Pro CVE-2026-8732: Critical Bug Exploited to Create

Quick take: A critical vulnerability in the WP Maps Pro WordPress plugin is being actively exploited to create rogue administrator accounts on vulnerable WordPress sites.

A critical vulnerability in the WP Maps Pro WordPress plugin is being actively exploited to create rogue administrator accounts on vulnerable WordPress sites. Tracked as CVE-2026-8732 with a CVSS score of 9.8 (Critical), the flaw affects all WP Maps Pro versions up to and including 6.1.0 — covering over 15,800 sales on Envato Market. The patch is available in version 6.1.1, released May 20, 2026.

What Is WP Maps Pro?

WP Maps Pro is a premium WordPress plugin for building interactive, customisable maps and store locators. It supports Google Maps, OpenStreetMap, and other providers, and is widely used by businesses, real estate agencies, travel sites, directories, and any organisation needing to display multiple locations on a WordPress site. With over 15,800 sales on Envato Market, the plugin has a substantial installed base across business and commercial websites.

How CVE-2026-8732 Works — The Technical Breakdown

The vulnerability originates in a "temporary access" feature built into WP Maps Pro, designed to let the plugin's vendor support staff log into customer sites for troubleshooting. The implementation had two critical security failures that together enabled complete site takeover by any unauthenticated attacker.

Failure 1: Unauthenticated AJAX Endpoint

The plugin registered the support access function using WordPress's wp_ajax_nopriv_ hook. This hook is intended for AJAX actions that legitimately need to work for logged-out visitors — for example, loading map data on a public page. Using it for an administrative function like account creation or site access is a fundamental misuse. It made the support endpoint accessible to any unauthenticated visitor who knew the endpoint name — including malicious actors.

Failure 2: Nonce Publicly Exposed in Frontend JavaScript

The only protection on the endpoint was a nonce check using fc-call-nonce. However, this nonce was embedded in publicly visible frontend JavaScript loaded on every page of the site. Any visitor — including an attacker — could read the nonce value from the page source and use it to bypass the nonce check. The protection was effectively non-functional against any attacker who loaded any page on the target site.

The Exploit Chain

With both protections bypassed, the attack is straightforward:

1. Attacker loads any page on the target site to harvest the publicly exposed nonce
2. Attacker sends a crafted AJAX POST request to the plugin's support endpoint, invoking the wpgmp_temp_access_support handler with check_temp=false
3. The handler unconditionally creates a new WordPress user with the hardcoded role of administrator via wp_insert_user()
4. The handler returns a magic login URL that calls wp_set_auth_cookie() when visited
5. Attacker visits the URL and is immediately authenticated as a full WordPress administrator
6. Complete site takeover achieved with no credentials, no brute force, no social engineering

Discovery, Disclosure, and Exploitation Timeline

What Attackers Do After Gaining Admin Access

Once an attacker has administrator access to a WordPress site, the potential consequences include:

• Malware installation — WordPress admin access allows uploading and executing arbitrary PHP files, enabling persistent server-level access
• Data theft — Access to all user data, contact form submissions, WooCommerce orders, and any personally identifiable information stored in the database
• SEO poisoning — Injecting spam content, malicious links, or redirects into the site to harm search rankings and redirect visitor traffic
• Credit card skimming — For WooCommerce sites, injecting JavaScript to capture payment card details at checkout
• Ransomware deployment — Encrypting site files and database to extort the site owner
• Lateral movement — Using the compromised hosting account to attack other sites on shared hosting environments

Immediate Action Checklist for WP Maps Pro Users

The Broader WordPress Security Lesson

CVE-2026-8732 exemplifies a recurring and preventable pattern in WordPress plugin security: privileged functions registered with unauthenticated AJAX hooks. The wp_ajax_nopriv_ hook is designed for actions that legitimately need to work for logged-out visitors. Developers must never use it for administrative operations. WordPress plugin auditors and security reviewers should specifically check every nopriv hook registration in a plugin's codebase to confirm that no privileged operations are reachable without authentication.

For agencies managing multiple client WordPress installations, this vulnerability pattern is particularly dangerous: a single compromised client site can serve as a staging ground for credential theft, malware distribution to site visitors, or lateral movement into agency infrastructure if the client site shares a hosting environment or access credentials with other managed sites.

Final Thoughts

WP Maps Pro CVE-2026-8732: Critical Bug Exploited to Create is worth reviewing with a practical lens: understand the risk or opportunity, map it to your environment, and take clear next steps instead of reacting to headlines.