ExploitPublished 31 May 2026

WP Maps Pro bug exploited to create admin accounts on WordPress sites

Source Bleeping Computer

Mentioned vulnerabilities

CVE-2026-8732

Fixed in 6.1.1 : update affected systems when convenient.

Data as of 1 Jun 2026, 21:57 UTC

Severity

Medium

Rated by Threat Radar

Patch: Available – fixed in 6.1.1

What to do

AI-suggested

A fixed version of WP Maps Pro (6.1.1) has been released that addresses CVE-2026-8732. Site administrators should update to version 6.1.1 or later immediately to remediate this vulnerability. No other mitigation steps are indicated by the vendor advisory. Given active exploitation attempts, prompt patching is critical.

Description

Hackers are targeting WordPress websites running a vulnerable version of the WP Maps Pro plugin, which allows creating rogue administrator accounts without authentication. [...]

Impact

Successful exploitation grants attackers administrator privileges on vulnerable WordPress sites, allowing them to inject persistent backdoors, modify site content, access sensitive data, deploy web shells, install malicious plugins, and fully take over the website. This represents a complete compromise of site security and control.

Summary

The WP Maps Pro plugin for WordPress contains a critical security flaw (CVE-2026-8732) in its 'temporary access' AJAX endpoint, which is accessible without authentication and protected only by a nonce exposed in frontend JavaScript. This allows attackers to send specially crafted requests that create new administrator accounts with a hardcoded email and a randomly generated username. The plugin then generates a passwordless 'magic login URL' for the new admin user and returns it to the attacker, enabling immediate admin-level access without any further verification. This vulnerability affects WP Maps Pro versions 6.1.0 and earlier. The issue was responsibly disclosed and fixed in version 6.1.1. Exploitation attempts have been observed in the wild, with security firms blocking thousands of attacks within a day.

References

bleepingcomputer.com/news/security/wp-maps-pro-bug-exploited-to-create-admin-accounts-on-wordpress-sites/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 31 May 2026, 14:18 UTC

References

Community reviews

Related threats