CVE-2026-8732 in WP Maps Pro Plugin
Summary
by MITRE • 05/29/2026
The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ and protected only by a nonce check using the fc-call-nonce nonce, which is publicly embedded into every frontend page via wp_localize_script as the nonce field of the wpgmp_local JavaScript object, rendering the check ineffective as an access control mechanism. This makes it possible for unauthenticated attackers to invoke the wpgmp_temp_access_support handler with check_temp=false, which unconditionally creates a new WordPress user with the hardcoded role of administrator via wp_insert_user() and returns a magic login URL that, when visited, calls wp_set_auth_cookie() to fully authenticate the attacker as the newly created administrator, resulting in complete site takeover.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 06/04/2026
The vulnerability in WP Maps Pro plugin represents a critical privilege escalation flaw that allows unauthenticated attackers to gain administrative control over affected WordPress installations. This issue affects all versions up to and including 6.1.0, making it a widespread concern for WordPress site administrators who have not yet updated their plugins. The vulnerability stems from improper access control mechanisms within the plugin's AJAX handling system, specifically through the wpgmp_temp_access_ajax action that is registered with wp_ajax_nopriv_ hook, which is typically intended for non-privileged users. The core technical flaw lies in the implementation of the nonce validation process where the fc-call-nonce nonce is publicly embedded in every frontend page through wp_localize_script function, making it accessible to any visitor without authentication requirements.
The operational impact of this vulnerability is severe as it enables complete site takeover without any authentication requirements. Attackers can exploit this flaw by invoking the wpgmp_temp_access_support handler with check_temp=false parameter, which bypasses all security checks and directly executes wp_insert_user() function to create a new administrator account. The hardcoded role assignment ensures that the newly created user automatically possesses full administrative privileges, providing attackers with complete control over the WordPress installation. The vulnerability is further compounded by the automatic generation of a magic login URL that, when accessed, calls wp_set_auth_cookie() to immediately authenticate the attacker as the newly created administrator, eliminating any additional authentication steps.
This vulnerability aligns with CWE-284 (Improper Access Control) and represents a classic example of insecure direct object reference where the nonce mechanism fails to provide effective access control. The ATT&CK framework categorizes this as a privilege escalation technique, specifically leveraging weak access controls and authentication bypass mechanisms. The flaw demonstrates poor security implementation where publicly accessible nonces are used for privileged operations, violating fundamental security principles of least privilege and proper authentication. The attack vector is particularly dangerous because it requires no prior authentication or authorization, making it accessible to anyone who can access the target website. Organizations using WP Maps Pro plugin versions 6.1.0 and earlier face immediate risk of complete system compromise, as attackers can execute arbitrary code, modify content, steal sensitive data, and potentially use the compromised site as a launching point for further attacks.
Mitigation strategies should include immediate plugin updates to versions that address this vulnerability, as well as implementing additional security measures such as restricting access to AJAX endpoints through proper authentication checks and monitoring for unauthorized user creation events. Site administrators should also consider implementing web application firewalls and security monitoring solutions that can detect and block suspicious AJAX requests targeting known vulnerable endpoints. The vulnerability serves as a reminder of the importance of proper nonce implementation and the need for robust access control mechanisms in web applications, particularly when dealing with privileged operations that can result in complete system compromise.