The WP Maps Pro plugin for WordPress contains a critical security flaw (CVE-2026-8732) in its 'temporary access' AJAX endpoint, which is accessible without authentication and protected only by a nonce exposed in frontend JavaScript. This allows attackers to send specially crafted requests that create new administrator accounts with a hardcoded email and a randomly generated username. The plugin then generates a passwordless 'magic login URL' for the new admin user and returns it to the attacker, enabling immediate admin-level access without any further verification. This vulnerability affects WP Maps Pro versions 6.1.0 and earlier. The issue was responsibly disclosed and fixed in version 6.1.1. Exploitation attempts have been observed in the wild, with security firms blocking thousands of attacks within a day.

Successful exploitation grants attackers administrator privileges on vulnerable WordPress sites, allowing them to inject persistent backdoors, modify site content, access sensitive data, deploy web shells, install malicious plugins, and fully take over the website. This represents a complete compromise of site security and control.

A fixed version of WP Maps Pro (6.1.1) has been released that addresses CVE-2026-8732. Site administrators should update to version 6.1.1 or later immediately to remediate this vulnerability. No other mitigation steps are indicated by the vendor advisory. Given active exploitation attempts, prompt patching is critical.