Wp Maps Pro
Monthly
Privilege escalation to full administrator in the WP Maps Pro WordPress plugin before 6.1.1 allows remote unauthenticated attackers to create a rogue admin account and obtain an interactive login. The plugin exposes an unauthenticated AJAX handler that trusts a nonce publicly rendered on any front-end page loading its map script, so the nonce provides no real authorization. Publicly available exploit code exists and a vendor patch is available; despite the 9.8 CVSS the EPSS probability is low (0.13%, 3rd percentile) and CISA SSVC records no observed exploitation.
Remote unauthenticated privilege escalation in the WP Maps Pro WordPress plugin (all versions through 6.1.0) allows attackers to create a new administrator account and authenticate as that user, resulting in complete site takeover. The flaw stems from an AJAX handler exposed to unauthenticated users and protected only by a publicly-embedded nonce, making the access check ineffective. No public exploit identified at time of analysis, but the trivial nature of the bug (default-enabled handler, no authentication, magic login URL returned to the caller) makes weaponization straightforward once details circulate.
Privilege escalation to full administrator in the WP Maps Pro WordPress plugin before 6.1.1 allows remote unauthenticated attackers to create a rogue admin account and obtain an interactive login. The plugin exposes an unauthenticated AJAX handler that trusts a nonce publicly rendered on any front-end page loading its map script, so the nonce provides no real authorization. Publicly available exploit code exists and a vendor patch is available; despite the 9.8 CVSS the EPSS probability is low (0.13%, 3rd percentile) and CISA SSVC records no observed exploitation.
Remote unauthenticated privilege escalation in the WP Maps Pro WordPress plugin (all versions through 6.1.0) allows attackers to create a new administrator account and authenticate as that user, resulting in complete site takeover. The flaw stems from an AJAX handler exposed to unauthenticated users and protected only by a publicly-embedded nonce, making the access check ineffective. No public exploit identified at time of analysis, but the trivial nature of the bug (default-enabled handler, no authentication, magic login URL returned to the caller) makes weaponization straightforward once details circulate.