Unauthenticated AJAX Issue in WP MAPS PRO Plugin Affects WordPress Security
CVE-2026-8935
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 15 June 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-8935?
The WP MAPS PRO plugin for WordPress contains a serious vulnerability that allows an unauthenticated attacker to create an administrator account without proper authorization. This security flaw is facilitated by an AJAX action that is registered publicly, exposing a valid nonce that can be accessed from any frontend page where the map script is loaded. Exploiting this vulnerability grants the attacker a magic-login URL, thereby providing them with unrestricted administrative access to the WordPress site.
Affected Version(s)
WP MAPS PRO 0 < 6.1.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.