CVE-2026-8732

CVE-2026-8732 is a critical (CVSS 9.8) unauthenticated privilege escalation flaw in the WP Maps Pro plugin for WordPress, affecting every version up to and including 6.1.0, so any site running one of these versions is exposed. The plugin registers its wpgmp_temp_access_ajax AJAX action for unauthenticated users but protects it only with the fc-call-nonce nonce, which is publicly embedded in every frontend page via the wpgmp_local JavaScript object, making the check ineffective as an access control mechanism (CWE-306, missing authentication). An unauthenticated attacker can invoke the wpgmp_temp_access_support handler with check_temp=false, which unconditionally creates a new WordPress user with the hardcoded administrator role via wp_insert_user() and returns a magic login URL that fully authenticates the attacker via wp_set_auth_cookie(). The result is complete site takeover without any credentials. The flaw is already being actively exploited in the wild to create rogue admin accounts according to current security reporting, a public proof-of-concept exists, and EPSS assigns a 21.5% probability of exploitation within 30 days (97th percentile).

What to do: Update WP Maps Pro to a release newer than 6.1.0 as soon as a patched version is published (the advisory lists all versions through 6.1.0 as vulnerable and names no fixed version); until then, deactivate the plugin or block unauthenticated requests to the wpgmp_temp_access_ajax action via a WAF. Audit the WordPress users list for administrator accounts you did not create, delete any rogue accounts, and expire active sessions and rotate admin credentials on sites where takeover is suspected.