EUVD-2026-33251
GHSA-v837-vph9-gcrq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify WordPress site running WP Maps Pro
-
DeliveryScrape fc-call-nonce from wpgmp_local script object
-
ExploitPOST wpgmp_temp_access_ajax with check_temp=false
-
InstallBackend creates hardcoded administrator user
-
C2Visit returned magic login URL to set auth cookie
-
ExecuteInstall backdoor or webshell for persistence
-
ImpactFull site takeover and data theft
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of any WordPress site with the WP Maps Pro plugin (versions through 6.1.0) installed and active. The only practical prerequisite is that the target site embeds the wpgmp_local script object on at least one publicly reachable page so the fc-call-nonce can be harvested, which is the plugin's default behavior whenever a map shortcode or block is present; on sites where the plugin is installed but no public page renders a map, the nonce may need to be sourced from an authenticated context, slightly raising the bar. No user interaction, no authentication, no privilege, and no non-default configuration is required beyond having the vulnerable plugin enabled. |
| Impact | All signals point to a top-priority issue. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) accurately reflects a remote, unauthenticated, low-complexity, no-user-interaction path to full administrative compromise - none of the typical CVSS-inflation caveats apply here. The vulnerability is not currently listed in CISA KEV and no EPSS score was provided in the input, and no public exploit identified at time of analysis, so confirmed in-the-wild activity has not been established. However, the description from Wordfence (a credible plugin-vulnerability research source) describes the full exploitation primitive including the exact AJAX action, parameter (check_temp=false), and post-exploitation flow, so weaponization is essentially a copy-paste exercise. WordPress plugins of this class are routinely mass-scanned, and bugs of this shape historically reach widespread exploitation within days of disclosure. |
| Exploit ScenarioDerived | An attacker fetches any front-end page of a target WordPress site running WP Maps Pro, scrapes the fc-call-nonce value from the embedded wpgmp_local JavaScript object, then issues a single POST to /wp-admin/admin-ajax.php with action=wpgmp_temp_access_ajax, the scraped nonce, and check_temp=false. The server creates an administrator account and returns a magic login URL; visiting that URL sets an authenticated admin cookie, after which the attacker installs a backdoor plugin, uploads a webshell, or pivots into connected infrastructure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 29, 2026
Remote unauthenticated privilege escalation in the WP Maps Pro WordPress plugin (all versions through 6.1.0) allows attackers to create a new administrator account and authenticate as that user, resulting in complete site takeover. The flaw stems from an AJAX handler exposed to unauthenticated users and protected only by a publicly-embedded nonce, making the access check ineffective. No public exploit identified at time of analysis, but the trivial nature of the bug (default-enabled handler, no authentication, magic login URL returned to the caller) makes weaponization straightforward once details circulate.
RemediationAI
No vendor-released patch identified at time of analysis based on the provided data, so site operators should treat the plugin as actively dangerous and either deactivate and remove WP Maps Pro entirely until FlipperCode publishes a version above 6.1.0, or apply specific compensating controls. Effective short-term mitigations include blocking POST requests to /wp-admin/admin-ajax.php where the action parameter equals wpgmp_temp_access_ajax (via WAF rule, mod_security, or nginx location block) - this breaks only the vulnerable handler without affecting map rendering. As an additional layer, audit wp_users for any administrator accounts created since the plugin was installed and not recognized by the site owner, since silent account creation is the exploitation footprint; rotate secrets and force password resets if any are found. Monitor https://www.wordfence.com/threat-intel/vulnerabilities/id/65988550-d39d-40be-8d25-647e7237062d?source=cve and the CodeCanyon listing for an official fix version and apply the exact released version once published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WP Maps Pro (vendor FlipperCode, CPE cpe:2.3:a:flippercode:wp_maps_pro) is a commercial Google Maps plugin for WordPress sold through CodeCanyon. The vulnerability is a textbook CWE-306 (Missing Authentication for Critical Function): the wpgmp_temp_access_ajax action is registered through wp_ajax_nopriv_, exposing it to unauthenticated visitors, while its only gate is a WordPress nonce (fc-call-nonce) that the plugin itself injects into every front-end page via wp_localize_script as the nonce property of the wpgmp_local JavaScript object. Because the nonce is publicly retrievable, it provides CSRF protection but no authentication or authorization. The wpgmp_temp_access_support handler then calls wp_insert_user() with a hardcoded administrator role when check_temp=false, and returns a 'magic' login URL that invokes wp_set_auth_cookie() on visit, completing the takeover end-to-end.
Know when Wp Maps Pro gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ and protected only by a nonce check using the fc-call-nonce nonce, which is publicly embedded into every frontend page via wp_localize_script as the nonce field of the wpgmp_local JavaScript object, rendering the check ineffective as an access control mechanism. This makes it possible for unauthenticated attackers to invoke the wpgmp_temp_access_support handler with check_temp=false, which unconditionally creates a new WordPress user with the hardcoded role of administrator via wp_insert_user() and returns a magic login URL that, when visited, calls wp_set_auth_cookie() to fully authenticate the attacker as the newly created administrator, resulting in complete site takeover.
Articles & Coverage 1
Executive ViewAI
WP Maps Pro WordPress plugin (versions ≤6.1.0) contains a critical remote authentication bypass enabling unauthenticated attackers to create administrator accounts and achieve complete site takeover. Organizations using this plugin face immediate compromise risk. No patch is currently available from the vendor.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Deactivate and remove WP Maps Pro immediately; (2) Deploy Web Application Firewall rules to block AJAX-based account creation requests to /wp-admin/admin-ajax.php; (3) Restrict WordPress administrative account creation via wp-config.php or security plugin configuration; (4) Enable access logging and monitor for unauthorized account creation events; (5) Conduct immediate audit of all WordPress administrator accounts for unauthorized additions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB