Privilege Escalation in WP Maps Pro Plugin by WordPress
CVE-2026-8732

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
WP Maps Pro
Vendor
CVE Published:
29 May 2026

Badges

📈 Trended📈 Score: 1,630👾 Exploit Exists🟡 Public PoC📰 News Worthy

What is CVE-2026-8732?

CVE-2026-8732 is a serious privilege escalation vulnerability found in the WP Maps Pro plugin for WordPress, impacting all versions up to and including 6.1.0. This plugin is designed to facilitate the integration of map functionalities into WordPress sites, allowing users to display Google Maps and related features seamlessly. The identified flaw is linked to the AJAX action wpgmp_temp_access_ajax, which is improperly protected due to its registration with the wp_ajax_nopriv_ action and reliance on a nonce that is exposed to the public. As a result, unauthenticated attackers can exploit this vulnerability to create a new administrator account without authorization. Once created, the attacker receives a login URL that grants them complete access and control over the site, effectively enabling a takeover. Organizations utilizing this plugin risk significant operational disruption, data compromise, and loss of control over their web presence.

Potential impact of CVE-2026-8732

  1. Complete Site Takeover: The vulnerability allows attackers to gain full administrative rights, enabling them to modify site content, install malicious plugins, or even delete the entire site.

  2. Data Breach and Compromise: Once an attacker has administrative access, there is a significant risk of data theft, including sensitive customer information, which can lead to privacy violations and regulatory repercussions.

  3. Reputation Damage: Organizations affected by this vulnerability may suffer reputational harm due to potential downtime, data leaks, or inappropriate content placed on their sites, which can erode user trust and impact customer relationships.

Affected Version(s)

WP Maps Pro 0 <= 6.0.4

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-8732
Created by HORKimhab

CVE-2026-8732
Created by Jenderal92

CVE-2026-8732
Created by zycoder0day

News Articles

favicon imageWebpronews

Critical WordPress Plugin Flaw Exposes 15,000 Sites to Instant Admin Takeover

A critical unauthenticated admin account creation flaw in WP Maps Pro (CVE-2026-8732) has triggered over 3,600 exploitation attempts in a single day across 15,000+ sites. The bug in the plugin's temporary access feature allows instant site takeover via a publicly exposed AJAX action. Updates and use...

3 weeks ago

favicon imageTnw

WP Maps Pro WordPress flaw exploited to create admin accounts

CVE-2026-8732 in WP Maps Pro lets unauthenticated attackers create admin accounts on 15,000+ WordPress sites. Wordfence blocked 2,858 attacks in 24 hours.

3 weeks ago

favicon imageIt Security News

WP Maps Pro Vulnerability Exploited to Take Over WordPress Sites - IT Security News

The security defect (CVE-2026-8732) allows unauthenticated attackers to create administrative accounts on the affected installations. The post WP Maps Pro Vulnerability Exploited to Take Over WordPress Sites appeared first on SecurityWeek. This article has been indexed from SecurityWeek Read the…Rea...

3 weeks ago

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://codecanyon.net/item/advanced-google-maps-plugin-f...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 📈

    Vulnerability started trending

  • 📰

    First article discovered by BleepingComputer

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

David Brown
.