EUVD-2026-33251
GHSA-v837-vph9-gcrq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ and protected only by a nonce check using the fc-call-nonce nonce, which is publicly embedded into every frontend page via wp_localize_script as the nonce field of the wpgmp_local JavaScript object, rendering the check ineffective as an access control mechanism. This makes it possible for unauthenticated attackers to invoke the wpgmp_temp_access_support handler with check_temp=false, which unconditionally creates a new WordPress user with the hardcoded role of administrator via wp_insert_user() and returns a magic login URL that, when visited, calls wp_set_auth_cookie() to fully authenticate the attacker as the newly created administrator, resulting in complete site takeover.
Articles & Coverage 1
AnalysisAI
Remote unauthenticated privilege escalation in the WP Maps Pro WordPress plugin (all versions through 6.1.0) allows attackers to create a new administrator account and authenticate as that user, resulting in complete site takeover. The flaw stems from an AJAX handler exposed to unauthenticated users and protected only by a publicly-embedded nonce, making the access check ineffective. No public exploit identified at time of analysis, but the trivial nature of the bug (default-enabled handler, no authentication, magic login URL returned to the caller) makes weaponization straightforward once details circulate.
Technical ContextAI
WP Maps Pro (vendor FlipperCode, CPE cpe:2.3:a:flippercode:wp_maps_pro) is a commercial Google Maps plugin for WordPress sold through CodeCanyon. The vulnerability is a textbook CWE-306 (Missing Authentication for Critical Function): the wpgmp_temp_access_ajax action is registered through wp_ajax_nopriv_, exposing it to unauthenticated visitors, while its only gate is a WordPress nonce (fc-call-nonce) that the plugin itself injects into every front-end page via wp_localize_script as the nonce property of the wpgmp_local JavaScript object. Because the nonce is publicly retrievable, it provides CSRF protection but no authentication or authorization. The wpgmp_temp_access_support handler then calls wp_insert_user() with a hardcoded administrator role when check_temp=false, and returns a 'magic' login URL that invokes wp_set_auth_cookie() on visit, completing the takeover end-to-end.
RemediationAI
No vendor-released patch identified at time of analysis based on the provided data, so site operators should treat the plugin as actively dangerous and either deactivate and remove WP Maps Pro entirely until FlipperCode publishes a version above 6.1.0, or apply specific compensating controls. Effective short-term mitigations include blocking POST requests to /wp-admin/admin-ajax.php where the action parameter equals wpgmp_temp_access_ajax (via WAF rule, mod_security, or nginx location block) - this breaks only the vulnerable handler without affecting map rendering. As an additional layer, audit wp_users for any administrator accounts created since the plugin was installed and not recognized by the site owner, since silent account creation is the exploitation footprint; rotate secrets and force password resets if any are found. Monitor https://www.wordfence.com/threat-intel/vulnerabilities/id/65988550-d39d-40be-8d25-647e7237062d?source=cve and the CodeCanyon listing for an official fix version and apply the exact released version once published.
More in Wp Maps Pro
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today