The WP MAPS PRO plugin versions prior to 6.1.1 register an unauthenticated AJAX action that accepts a valid nonce publicly exposed on frontend pages loading the map script. This flaw allows an attacker to unconditionally create a new administrator account and receive a magic-login URL, granting interactive administrator access without authentication. The vulnerability is classified under CWE-269 (Improper Privilege Management). No CVSS score or official remediation level is currently provided, and no patch links are available. The vulnerability is not related to a cloud service and no known exploits in the wild have been reported as of the publication date.

An attacker can gain unauthorized administrator-level access to a WordPress site running the vulnerable WP MAPS PRO plugin. This access allows full control over the site, including content modification, user management, and potential further compromise of the hosting environment. The vulnerability effectively bypasses authentication and privilege checks by leveraging a publicly available nonce and an unauthenticated AJAX endpoint.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin or disable it if possible. Monitor vendor channels for updates and apply any official patches promptly once available.