The WP MAPS PRO WordPress plugin versions prior to 6.1.1 register an unauthenticated AJAX action that, when invoked with a valid nonce publicly exposed on frontend pages loading the map script, unconditionally creates a new administrator account. It then returns a magic-login URL that provides interactive administrator access to the attacker. This is a CWE-269 (Improper Privilege Management) vulnerability with a CVSS 3.1 base score of 9.8, indicating critical severity. No official patch or remediation level is currently confirmed in the provided data.

Successful exploitation results in an attacker gaining full administrative privileges on the affected WordPress site without authentication. This includes complete control over site content, configuration, and potentially the underlying server environment, leading to full compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to frontend pages that enqueue the vulnerable map script or disable the WP MAPS PRO plugin. Monitor vendor channels for updates and apply patches immediately once released.