WP Maps Pro EUVD-2026-36699

The only prerequisite is that the target site runs WP Maps Pro before 6.1.1 and serves at least one front-end page that enqueues the plugin's map script, because that page publicly emits the nonce the vulnerable AJAX action requires; no authentication, user interaction, or non-default configuration is otherwise needed (AV:N/AC:L/PR:N/UI:N). The practical limiting factor is nonce availability: if no public page loads the map script, an attacker must first find or reach one that does, and standard WordPress nonce lifetime (roughly 12-24 hours) bounds how long a scraped nonce stays valid, though it can simply be re-fetched.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) accurately reflects a network-reachable, no-privilege, no-interaction path to full site takeover, and SSVC rates Technical Impact as total and the attack as Automatable - both consistent with a high-priority issue. The tension is in the exploitation-likelihood signals: EPSS is only 0.13% (3rd percentile) and CISA SSVC lists Exploitation as 'none', indicating no confirmed active exploitation yet, even though publicly available exploit code exists. This is a genuine priority for anyone running the plugin because exploitation is trivial and fully automatable, but the low EPSS suggests it is not yet the subject of widespread mass scanning; that can change rapidly once a POC circulates. Note the 'Information Disclosure' tag understates the impact - this is account creation and privilege escalation, not mere disclosure - so triage on the description and CVSS rather than the tag.

An attacker loads any public page of the target WordPress site that displays a WP Maps Pro map, scrapes the nonce embedded in the page's script data, and replays it to the plugin's unauthenticated AJAX action. The endpoint unconditionally creates a new administrator account and returns a magic-login URL, which the attacker opens to gain interactive admin access and full control of the site. Publicly available exploit code lowers the skill needed to near zero and the attack is fully scriptable across many sites.