Critical WP Maps Pro Vulnerability Under Active Exploitation Allows Creation of Admin Accounts
Attackers are actively exploiting a severe security flaw in WP Maps Pro – a popular WordPress plugin sold nearly 16,000 times on the Envato Market – to inject administrator accounts into vulnerable websites. The plugin is commonly used to display configurable Google Maps and OpenStreetMap embeds with markers, listings and other location-based features, and is frequently deployed as a store locator for customers to find nearby outlets, view details and get directions.
The flaw is tracked as CVE-2026-8732 and carries a CVSS rating of 9.8. It is a privilege-escalation vulnerability that enables unauthenticated adversaries to create a WordPress user with administrator privileges, effectively granting full control of affected sites. All releases of the plugin up to and including 6.1.0 are impacted; the issue was fixed in version 6.1.1.
Security researcher David Brown is credited with discovering and reporting the defect. At its core, the problem stems from a “temporary access” capability meant to let support personnel sign into a customer site for troubleshooting. That mechanism can be invoked without sufficient validation, exposing a path for attackers to escalate privileges.
Specifically, the vulnerability arises because unauthenticated requests can call the wpgmp_temp_access_support() routine. The AJAX action wpgmp_temp_access_ajax is registered with wp_ajax_nopriv_, and its sole protection is a nonce check relying on the “fc-call-nonce” token. However, that nonce is embedded publicly on all frontend pages via wp_localize_script as the nonce field of the wpgmp_local JavaScript object, which renders the nonce ineffective for access control, according to Wordfence.
Because of this setup, unauthenticated actors can trigger the wpgmp_temp_access_support handler with check_temp=false. When that happens, the plugin unconditionally creates a new WordPress account with a hardcoded administrator role using wp_insert_user(), and responds with a “magic” login URL. Visiting that link invokes wp_set_auth_cookie(), which logs the attacker in as the newly created administrator and results in a complete site takeover.
The plugin’s maintainers issued a patch on May 20, 2026, which restricts access to the vulnerable endpoint so that only authenticated administrators can use it. Despite the fix, exploitation has been observed in the wild: Wordfence reports blocking 2,858 attempts exploiting this issue in the past 24 hours alone.
Site owners running WP Maps Pro should immediately update to version 6.1.1 or later to mitigate the risk. If you cannot apply the update right away, consider temporarily disabling the plugin or removing the affected endpoint until a patch can be installed.
For more context on the vendor and plugin, WP Maps Pro provides advanced location features for WordPress and is a widely used store locator solution sold through the Envato Market.