Threat actors are actively exploiting a critical vulnerability in WP Maps Pro, a popular WordPress plugin used to add Google Maps, OpenStreetMap, store locators, markers, listings, and location-based features to websites.
The flaw, tracked as CVE-2026-8732, carries a CVSS score of 9.8 and allows unauthenticated attackers to create new WordPress administrator accounts on vulnerable sites.
In practical terms, this means attackers can take over affected WordPress websites without needing a username, password, or existing account.
The vulnerability affects all WP Maps Pro versions up to and including 6.1.0. It has been fixed in version 6.1.1, and site owners should update immediately.
Why This Vulnerability Is Critical
Many WordPress site owners use WP Maps Pro as a location and store locator plugin. Businesses use it to display branch locations, service areas, markers, directions, and location listings.
Because it runs inside WordPress, a serious flaw in the plugin can directly affect the entire website.
CVE-2026-8732 is especially dangerous because it allows privilege escalation without authentication. An attacker does not need to log in first. They can abuse the vulnerable endpoint to create a new WordPress user with administrator permissions.
Once an attacker has administrator access, they may be able to:
- modify website content
- install malicious plugins
- upload web shells
- redirect visitors to phishing pages
- steal customer or form data
- inject SEO spam
- create hidden backdoor accounts
- disable security plugins
- access sensitive configuration files
- pivot into hosting infrastructure
- use the site for malware distribution
For business websites, this can quickly become a full site compromise.
What Caused the Issue?
The vulnerability is related to a temporary access feature in WP Maps Pro.
This feature was designed to allow support staff to access a customer’s site during troubleshooting. Temporary support access features can be useful, but they must be carefully protected because they can create privileged access paths.
In this case, the vulnerable process allowed unauthenticated users to invoke a function called:
wpgmp_temp_access_support()
The issue was exposed through an AJAX action named:
wpgmp_temp_access_ajax
This action was registered using wp_ajax_nopriv_, which means it could be accessed by users who were not logged in.
The only protection was a nonce check using fc-call-nonce. However, that nonce was publicly embedded into frontend pages through the wpgmp_local JavaScript object.
Because the nonce was available to visitors, it could not act as a real access control mechanism.
How Attackers Abuse the Flaw
According to Wordfence, attackers can invoke the vulnerable handler with check_temp=false.
This causes the plugin to create a new WordPress user with the hardcoded role of administrator using wp_insert_user().
The vulnerable process then returns a magic login URL. When the attacker visits that URL, WordPress calls wp_set_auth_cookie() and authenticates the attacker as the newly created administrator.
The result is complete site takeover.
The attack chain can be summarized as:
- Attacker visits a vulnerable site.
- Attacker obtains the publicly exposed nonce from the frontend.
- Attacker calls the unauthenticated AJAX endpoint.
- The plugin creates a new administrator user.
- The plugin returns a login URL.
- The attacker uses the URL to authenticate as admin.
- The attacker gains full control of the WordPress site.
This is why the vulnerability is rated critical.
Active Exploitation Is Already Underway
The issue is not theoretical.
Wordfence reported blocking 2,858 attacks targeting the vulnerability within 24 hours.
That means attackers are already scanning for vulnerable WordPress sites and attempting to exploit the flaw.
When WordPress plugin vulnerabilities become public, exploitation can begin quickly because attackers can automate scanning across large numbers of websites.
Sites that delay patching are at high risk.
Fixed Version Available
The WP Maps Pro maintainers released a patch on May 20, 2026.
The vulnerability is fixed in:
WP Maps Pro 6.1.1
The patch restricts access to the vulnerable endpoint so that only authenticated administrators can use it.
Site owners running version 6.1.0 or older should update immediately.
What Site Owners Should Do Now
If your WordPress site uses WP Maps Pro, take the following steps immediately:
- update WP Maps Pro to version 6.1.1 or later
- review all WordPress administrator accounts
- remove any unknown or suspicious admin users
- check recent user creation events
- review plugin and theme file changes
- inspect recently installed plugins
- check for suspicious redirects or injected scripts
- review web server access logs for suspicious AJAX requests
- scan the site for malware and web shells
- rotate WordPress admin passwords
- rotate hosting, FTP, SFTP, and database credentials if compromise is suspected
- ensure backups are clean and available
- enable multi-factor authentication for WordPress administrators
If an unknown administrator account is found, assume the site may already be compromised.
What Security Teams Should Monitor
Administrators and hosting providers should monitor for signs of exploitation.
Useful indicators include:
- unexpected administrator account creation
- requests to
admin-ajax.phpinvolving WP Maps Pro actions - suspicious use of
wpgmp_temp_access_ajax - new users created without normal admin activity
- unexpected login sessions from unusual IP addresses
- new plugins or themes installed without approval
- modified PHP files
- suspicious scheduled tasks or cron jobs
- outbound connections from the web server
- injected JavaScript in posts, pages, headers, or footers
Because attackers may create backdoors after gaining admin access, cleanup should not stop at updating the plugin.
Why Nonces Are Not Access Control
One of the key lessons from this vulnerability is that WordPress nonces should not be treated as full access control.
A nonce can help protect against certain request-forgery scenarios, but if it is publicly available on frontend pages, it cannot prove that a user is authorized to perform a privileged action.
Sensitive operations such as creating users, generating login links, or changing permissions must require strong authorization checks, such as confirming that the current user is logged in and has administrator capability.
Developers should always pair nonce validation with proper permission checks like current_user_can().
Lessons for WordPress Plugin Developers
This incident is also a reminder for plugin developers.
Any feature that creates temporary access, support accounts, magic login links, or privileged users must be treated as high risk.
Secure plugin design should include:
- strict authentication checks
- role and capability validation
- no privileged actions through unauthenticated AJAX endpoints
- no hardcoded administrator role creation from public requests
- short-lived and tightly scoped support access
- audit logging for temporary access creation
- clear admin visibility into support access events
- secure revocation of temporary accounts
- protection against public nonce abuse
Convenience features can become takeover features if not designed carefully.
Why WordPress Plugins Remain a Major Attack Surface
WordPress powers a large portion of the web, and plugins extend its functionality. That popularity makes plugins attractive targets.
Attackers regularly exploit plugin vulnerabilities because many site owners delay updates or run abandoned plugins.
Common plugin-related risks include:
- unauthenticated AJAX actions
- missing capability checks
- insecure file uploads
- SQL injection
- stored cross-site scripting
- privilege escalation
- exposed debug or support features
- weak nonce handling
- insecure deserialization
- remote code execution
Even a single vulnerable plugin can compromise the entire site.
Final Thoughts
CVE-2026-8732 is a critical vulnerability because it allows unauthenticated attackers to create administrator accounts and fully take over WordPress sites running vulnerable versions of WP Maps Pro.
The flaw has already come under active exploitation, making immediate patching essential.
Site owners should update to WP Maps Pro 6.1.1 or later, audit administrator accounts, review logs, and investigate for signs of compromise.
For WordPress administrators, the message is clear: plugin updates are not optional maintenance. They are a core part of website security.
A mapping plugin may seem harmless, but when it can create admin users without authentication, it becomes a direct path to full site takeover.
