EUVD-2026-36699
GHSA-j5mr-6rv3-xgwh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network AJAX call gated only by a publicly emitted nonce (PR:N/UI:N/AC:L) yields full admin account creation, giving total confidentiality, integrity, and availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuing its map script, unconditionally creates an administrator account and returns a magic-login URL granting interactive admin access.
Articles & Coverage 1
AnalysisAI
Privilege escalation to full administrator in the WP Maps Pro WordPress plugin before 6.1.1 allows remote unauthenticated attackers to create a rogue admin account and obtain an interactive login. The plugin exposes an unauthenticated AJAX handler that trusts a nonce publicly rendered on any front-end page loading its map script, so the nonce provides no real authorization. Publicly available exploit code exists and a vendor patch is available; despite the 9.8 CVSS the EPSS probability is low (0.13%, 3rd percentile) and CISA SSVC records no observed exploitation.
Technical ContextAI
WP Maps Pro is a commercial mapping/store-locator plugin for WordPress that registers AJAX endpoints via WordPress's admin-ajax.php mechanism. WordPress nonces are intended as CSRF tokens, not authentication secrets, and are only effective when the endpoint also enforces a capability check. Here the plugin registered its account-creation action as an unauthenticated (wp_ajax_nopriv) handler and gated it solely on a nonce that is emitted in the page markup wherever the map script is enqueued, meaning any visitor can read a valid nonce and satisfy the check. The root cause is a missing authorization/capability check (broadly CWE-862 Missing Authorization / CWE-269 Improper Privilege Management, though the feed lists CWE as N/A), compounded by treating a publicly disclosed nonce as an authentication control. The affected CPE is cpe:2.3:a:unknown:wp_maps_pro:*, with the vendor recorded as unknown in the NVD/EUVD data.
RemediationAI
Upgrade WP Maps Pro to version 6.1.1 or later, which is the vendor-released patch that fixes the missing authorization check (Vendor-released patch: 6.1.1). Because publicly available exploit code exists, treat this as urgent and, before patching, audit the WordPress user list for unexpected administrator accounts and unfamiliar recent registrations, removing any rogue admins and rotating credentials and secret keys for existing admins. If immediate patching is not possible, compensating controls include blocking or restricting access to /wp-admin/admin-ajax.php for the plugin's specific action at a WAF or reverse proxy (side effect: may break legitimate front-end map interactions that rely on that endpoint), or fully deactivating and removing the plugin until it can be updated (side effect: map/store-locator features go offline). Refer to the WPScan advisory (https://wpscan.com/vulnerability/9bad9fc1-5032-45dc-983f-ba2dd7092385/) for details.
More in Wp Maps Pro
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today