What is the CVSS score of CVE-2026-8732?

CVE-2026-8732 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of WP Maps Pro are affected by CVE-2026-8732?

WP Maps Pro WordPress plugin (versions ≤6.1.0) contains a critical remote authentication bypass enabling unauthenticated attackers to create administrator accounts and achieve complete site takeover.

How to fix or mitigate CVE-2026-8732?

24 hours: Deactivate WP Maps Pro; audit WordPress user table for unauthorized administrator accounts added in recent weeks; review web server access logs for suspicious AJAX requests. 7 days: Remove the plugin entirely, or if functionality is critical, deploy Web Application Firewall rules to block /wp-admin/admin-ajax.php and restrict WordPress administrative account creation via wp-config.php settings. 30 days: Monitor WP Maps Pro vendor advisories for patch availability; identify and deploy alternative plugin if no fix released.

WP Maps Pro CVE-2026-8732

EUVD-2026-33251 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-05-29 Wordfence

GHSA-v837-vph9-gcrq

Privilege Escalation WordPress Authentication Bypass

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 06:43 vuln.today

CVE Published

May 29, 2026 - 05:32 nvd

CRITICAL 9.8

DescriptionCVE.org

The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ and protected only by a nonce check using the fc-call-nonce nonce, which is publicly embedded into every frontend page via wp_localize_script as the nonce field of the wpgmp_local JavaScript object, rendering the check ineffective as an access control mechanism. This makes it possible for unauthenticated attackers to invoke the wpgmp_temp_access_support handler with check_temp=false, which unconditionally creates a new WordPress user with the hardcoded role of administrator via wp_insert_user() and returns a magic login URL that, when visited, calls wp_set_auth_cookie() to fully authenticate the attacker as the newly created administrator, resulting in complete site takeover.

AnalysisAI

Remote unauthenticated privilege escalation in the WP Maps Pro WordPress plugin (all versions through 6.1.0) allows attackers to create a new administrator account and authenticate as that user, resulting in complete site takeover. The flaw stems from an AJAX handler exposed to unauthenticated users and protected only by a publicly-embedded nonce, making the access check ineffective. No public exploit identified at time of analysis, but the trivial nature of the bug (default-enabled handler, no authentication, magic login URL returned to the caller) makes weaponization straightforward once details circulate.

Technical ContextAI

WP Maps Pro (vendor FlipperCode, CPE cpe:2.3:a:flippercode:wp_maps_pro) is a commercial Google Maps plugin for WordPress sold through CodeCanyon. The vulnerability is a textbook CWE-306 (Missing Authentication for Critical Function): the wpgmp_temp_access_ajax action is registered through wp_ajax_nopriv_, exposing it to unauthenticated visitors, while its only gate is a WordPress nonce (fc-call-nonce) that the plugin itself injects into every front-end page via wp_localize_script as the nonce property of the wpgmp_local JavaScript object. Because the nonce is publicly retrievable, it provides CSRF protection but no authentication or authorization. The wpgmp_temp_access_support handler then calls wp_insert_user() with a hardcoded administrator role when check_temp=false, and returns a 'magic' login URL that invokes wp_set_auth_cookie() on visit, completing the takeover end-to-end.

RemediationAI

No vendor-released patch identified at time of analysis based on the provided data, so site operators should treat the plugin as actively dangerous and either deactivate and remove WP Maps Pro entirely until FlipperCode publishes a version above 6.1.0, or apply specific compensating controls. Effective short-term mitigations include blocking POST requests to /wp-admin/admin-ajax.php where the action parameter equals wpgmp_temp_access_ajax (via WAF rule, mod_security, or nginx location block) - this breaks only the vulnerable handler without affecting map rendering. As an additional layer, audit wp_users for any administrator accounts created since the plugin was installed and not recognized by the site owner, since silent account creation is the exploitation footprint; rotate secrets and force password resets if any are found. Monitor https://www.wordfence.com/threat-intel/vulnerabilities/id/65988550-d39d-40be-8d25-647e7237062d?source=cve and the CodeCanyon listing for an official fix version and apply the exact released version once published.