CVE-2026-8732: WP Maps Pro <= 6.1.0 - Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX Action
The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmptempaccessajax AJAX action being registered with wpajaxnopriv and protected only by a nonce check using the fc-call-nonce nonce, which is publicly embedded into every frontend page via wplocalizescript as the nonce field of the wpgmplocal JavaScript object, rendering the check ineffective as an access control mechanism. This makes it possible for unauthenticated attackers to invoke the wpgmptempaccesssupport handler with checktemp=false, which unconditionally creates a new WordPress user with the hardcoded role of administrator via wpinsertuser() and returns a magic login URL that, when visited, calls wpsetauthcookie() to fully authenticate the attacker as the newly created administrator, resulting in complete site takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: WP Maps Proto a version that resolves this vulnerability.Fixed in 6.1.0 - Configuration
Ensure wpgmp_temp_access_support does not proceed with user creation when check_temp=false; require the intended authenticated/authorized condition rather than relying on the fc-call-nonce nonce embedded via wp_localize_script.
WP Maps Pro wpgmp_temp_access_support handler (check_temp) = true - Compensating control
Restrict unauthenticated access to the affected WordPress AJAX endpoint(s) by blocking requests to wpgmp_temp_access_ajax / wpgmp_temp_access_support for non-authenticated users (e.g., via WAF/ACL rules matching the AJAX action).
- Operational
If exploitation occurred, immediately remove the attacker-created administrator account(s) and rotate any exposed credentials/tokens used by the site admins.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8732?
CVE-2026-8732 has a critical severity rating of 9.8.
How do I fix CVE-2026-8732?
To fix CVE-2026-8732, update the WP Maps Pro plugin to version 6.1.1 or later.
What type of vulnerability is CVE-2026-8732?
CVE-2026-8732 is a privilege escalation vulnerability that allows unauthenticated users to create administrator accounts.
Which versions of WP Maps Pro are affected by CVE-2026-8732?
All versions of WP Maps Pro up to and including 6.1.0 are affected by CVE-2026-8732.
What is the attack vector for CVE-2026-8732?
CVE-2026-8732 can be exploited remotely without authentication due to the wpgmp_temp_access_ajax AJAX action.