flippercode WP Maps Pro Plugin up to 6.0.4 on WordPress Javascript Object wpgmp_temp_access_ajax nonce missing authentication

Summaryinfo

A vulnerability categorized as critical has been discovered in flippercode WP Maps Pro Plugin up to 6.0.4 on WordPress. Impacted is the function wpgmp_temp_access_ajax of the component Javascript Object Handler. Such manipulation of the argument nonce leads to missing authentication. This vulnerability is referenced as CVE-2026-8732. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in flippercode WP Maps Pro Plugin up to 6.0.4 on WordPress. Affected by this issue is the function wpgmp_temp_access_ajax of the component Javascript Object Handler. The manipulation of the argument nonce with an unknown input leads to a missing authentication vulnerability. Using CWE to declare the problem leads to CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ and protected only by a nonce check using the fc-call-nonce nonce, which is publicly embedded into every frontend page via wp_localize_script as the nonce field of the wpgmp_local JavaScript object, rendering the check ineffective as an access control mechanism. This makes it possible for unauthenticated attackers to invoke the wpgmp_temp_access_support handler with check_temp=false, which unconditionally creates a new WordPress user with the hardcoded role of administrator via wp_insert_user() and returns a magic login URL that, when visited, calls wp_set_auth_cookie() to fully authenticate the attacker as the newly created administrator, resulting in complete site takeover.

The weakness was published by David Brown. The advisory is available at wordfence.com. This vulnerability is handled as CVE-2026-8732 since 05/16/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 05/29/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-33251). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• WordPress Plugin

Vendor

• flippercode

Name

• WP Maps Pro Plugin

Version

• 6.0.0
• 6.0.1
• 6.0.2
• 6.0.3
• 6.0.4

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion