CVE-2026-8732 in WP Maps Pro is a critical unauthenticated remote code execution vector with a CVSS score of 9.8, and that score is earned. The vulnerability isn't a single mistake — it's an architectural failure where every protective layer was either fundamentally misdesigned or entirely absent. The AJAX endpoint handling the 'temporary admin' feature was registered with wp_ajaxnopriv, explicitly permitting unauthenticated requests. The nonce meant to protect it was embedded in frontend JavaScript via wp_localize_script, making it a public constant rather than a secret. There's no security boundary here to breach — the developer built a doorway and left it wide open while believing they'd installed a lock. The feature creates a hardcoded administrator account with no expiration, no cleanup, and returns working credentials directly to the requester. Visit the generated URL and you're authenticated as admin with full site control. This is complete site takeover with zero prerequisites — no钓鱼, no credential guessing, no lateral movement required. The pattern of magic login URLs, hardcoded admin creation, exposed nonces, and unauthenticated AJAX endpoints has appeared in numerous compromised WordPress plugins over the past fifteen years. Whether this represents malicious code, incompetent development, or a support feature that escaped into production and was never audited, the result is identical: maximum damage with minimum effort. If you're running WP Maps Pro, patch immediately — and audit your other plugins for the same topology. This isn't a nonce bypass; it's a control that was architecturally incapable of providing access control from inception.
CVE-2026-8732
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedThe WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ and protected only by a nonce check using the fc-call-nonce nonce, which is publicly embedded into every frontend page via wp_localize_script as the nonce field of the wpgmp_local JavaScript object, rendering the check ineffective as an access control mechanism. This makes it possible for unauthenticated attackers to invoke the wpgmp_temp_access_support handler with check_temp=false, which unconditionally creates a new WordPress user with the hardcoded role of administrator via wp_insert_user() and returns a magic login URL that, when visited, calls wp_set_auth_cookie() to fully authenticate the attacker as the newly created administrator, resulting in complete site takeover.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceThe WP Maps Pro plugin for WordPress has a critical privilege escalation vulnerability in versions up to 6.1.0. The wpgmp_temp_access_ajax AJAX action is registered with wp_ajax_nopriv_ (allowing unauthenticated access) but is protected only by a nonce (fc-call-nonce) that is publicly embedded in every frontend page via wp_localize_script, making it trivial for attackers to obtain. Unauthenticated attackers can invoke wpgmp_temp_access_support with check_temp=false to unconditionally create a new administrator account via wp_insert_user() and receive a magic login URL that calls wp_set_auth_cookie(), achieving full site takeover.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Confirm WP Maps Pro plugin installation statusIn WordPress admin, go to Plugins > Installed Plugins and look for 'WP Maps Pro' in the list. Note whether it appears and whether it is activated.Affected if The plugin is installed and active
-
Identify installed version of WP Maps ProIn the Plugins list, click on the plugin name to view details, or access the main plugin PHP file via FTP/file manager at wp-content/plugins/ and read the version number from the plugin header comment.Affected if Version is unknown, unpatched, or within an affected range
-
Test for accessible vulnerable AJAX endpointMake a GET or POST request to yoursite.com/wp-admin/admin-ajax.php?action=wpgmp_temp_access_ajax. If the plugin is active and vulnerable, the endpoint will respond (may return 0 or an error rather than a 403).Affected if The endpoint is reachable and responds without requiring authentication
-
Audit WordPress user accounts for unauthorized adminsIn WordPress admin, go to Users > All Users. Review all accounts with the Administrator role. Look for accounts you did not create, unfamiliar usernames, or accounts created recently without your action.Affected if There are administrator accounts you did not create or that appear suspicious
You are affected if WP Maps Pro plugin is active and the vulnerable AJAX action is accessible, particularly if unauthorized administrator accounts exist in your WordPress installation.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataUpdate the WP Maps Pro plugin to a version beyond 6.1.0 when available. Immediately audit the site for unauthorized administrator accounts and remove any suspicious users. Consider disabling or removing the plugin until a patch is applied.
- Consultation3.0 h
- Implementation4.0 h
- Testing3.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,408.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-8732 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesCVE-2026-8732 in WP Maps Pro is a critical unauthenticated remote code execution vector with a CVSS score of 9.8, and that score is earned. The vulnerability isn't a single mistake — it's an architectural failure where every protective layer was either fundamentally misdesigned or entirely absent. The AJAX endpoint handling the 'temporary admin' feature was registered with wp_ajax_nopriv_, explicitly permitting unauthenticated requests. The nonce meant to protect it was embedded in frontend JavaScript via wp_localize_script, making it a public constant rather than a secret. There's no security boundary here to breach — the developer built a doorway and left it wide open while believing they'd installed a lock. The feature creates a hardcoded administrator account with no expiration, no cleanup, and returns working credentials directly to the requester. Visit the generated URL and you're authenticated as admin with full site control. This is complete site takeover with zero prerequisites — no钓鱼, no credential guessing, no lateral movement required. The pattern of magic login URLs, hardcoded admin creation, exposed nonces, and unauthenticated AJAX endpoints has appeared in numerous compromised WordPress plugins over the past fifteen years. Whether this represents malicious code, incompetent development, or a support feature that escaped into production and was never audited, the result is identical: maximum damage with minimum effort. If you're running WP Maps Pro, patch immediately — and audit your other plugins for the same topology. This isn't a nonce bypass; it's a control that was architecturally incapable of providing access control from inception.
Practitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-8732 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data