Critical WP Maps Pro Flaw Actively Exploited to Create Admin Accounts
A critical WP Maps Pro bug lets unauthenticated attackers create admin accounts. Wordfence says it has already blocked thousands of attack attempts.
Intelligence analysis by GPT-5.4 Mini
WP Maps Pro, a WordPress plugin with more than 15,000 Envato sales, has a critical privilege-escalation flaw tracked as CVE-2026-8732. Wordfence says attackers are actively using it to create administrator accounts, and the issue is fixed in version 6.1.1.
A piece of WordPress software used for maps had a serious hole in it. That hole let a stranger make themselves the boss of the website without needing a password.
It is like a building where the side door says "support only," but the lock is made from paper. The article says attackers could walk in, create their own key, and open the front door.
The good news is the fix already exists in version 6.1.1. The bad news is that people are already trying the trick on real websites, so updates need to happen fast.
Analysis
What happened
WP Maps Pro, a WordPress plugin used for maps, store locators, and location listings, contained a critical privilege-escalation flaw tracked as CVE-2026-8732. The bug affects all versions up to and including 6.1.0 and carries a CVSS score of 9.8.
How the bug works
According to Wordfence, the problem sits in a "temporary access" support feature meant to let support staff log in during troubleshooting. The vulnerable AJAX endpoint is available to unauthenticated users, and the protection relies on a nonce that is publicly embedded on frontend pages. That means the check does not stop an attacker from reaching the handler.
Wordfence says an attacker can call the support function with check_temp=false, which creates a new WordPress user with the hardcoded administrator role. The handler then returns a magic login URL; visiting it triggers authentication cookies and gives the attacker full access as that new admin.
Patch and exploitation
The plugin maintainers released a fix on May 20, 2026, in version 6.1.1. The patch limits access so only authenticated administrators can use the endpoint.
The concern is urgency: Wordfence says it has blocked 2,858 attacks targeting the issue in the past 24 hours, showing that the flaw is already being used in the wild. Security researcher David Brown is credited with discovering and reporting the bug.
Site owners running WP Maps Pro should update immediately, since this issue can turn a public WordPress site into a fully compromised one with little effort from an attacker.
Key points
- WP Maps Pro has a critical privilege-escalation flaw tracked as CVE-2026-8732.
- The bug can let unauthenticated attackers create WordPress administrator accounts.
- Wordfence says it has seen active exploitation and blocked 2,858 attacks in 24 hours.
- The vulnerability affects versions through 6.1.0 and is fixed in 6.1.1.
- Security researcher David Brown is credited with reporting the issue.
