WP Maps Pro bug exploited to create admin accounts on WordPress sites
Attackers are exploiting a critical WP Maps Pro flaw to create rogue WordPress admin accounts without logging in.
Intelligence analysis by GPT-5.4 Mini
A critical bug in WP Maps Pro lets attackers trigger admin-account creation through an exposed AJAX endpoint. Defiant says it has already blocked thousands of exploit attempts, and the vendor fixed the issue in version 6.1.1.
A website helper tool had a broken secret door. Bad actors found it and used it to make themselves a boss account on WordPress sites.
That is like someone sneaking into a store office, printing a manager badge, and walking out with the keys. Once they are inside, they can change signs, open drawers, or lock the real owner out.
The tool’s maker fixed it in a newer version. Sites that have not updated are still at risk, and the article says attacks are already happening.
Analysis
What happened
WP Maps Pro, a premium WordPress plugin used for maps and store locators, had a critical authentication flaw tracked as CVE-2026-8732. The issue affects version 6.1.0 and earlier, and it can be abused to create administrator accounts without needing a valid login.
How the flaw works
The vulnerable code sits behind a “temporary access” feature that was meant to help vendor support staff troubleshoot customer sites. Security researcher David Brown found that the AJAX endpoint behind that feature was reachable by unauthenticated users. The protection depended on a nonce check exposed in frontend JavaScript, which did not provide real security.
That meant an attacker could send a crafted request that makes the plugin create a new WordPress user, assign it the administrator role, and generate a passwordless login link. Once the attacker opens that link, they are logged into the new admin account immediately, with no password or extra verification.
Why this is dangerous
Defiant, the WordPress security company that observed live abuse, says it blocked more than 3,600 exploit attempts in the past 24 hours. With admin-level access, an attacker can modify site content, steal private data, install malicious plugins, deploy web shells, and leave behind persistent backdoors.
The vendor was notified after the flaw was validated, and WP Maps Pro 6.1.1 was released on May 20 with a fix. The article’s bottom line is simple: sites still running vulnerable versions need to update now, because exploitation is already underway.
Key points
- CVE-2026-8732 affects WP Maps Pro 6.1.0 and earlier.
- The bug lets unauthenticated attackers create WordPress administrator accounts.
- Defiant says it blocked more than 3,600 exploit attempts in 24 hours.
- WP Maps Pro 6.1.1, released on May 20, 2026, fixes the flaw.
- Full admin access can lead to backdoors, content tampering, and data theft.
