External risk intelligence

WP Maps Pro Administrator Account Creation Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-8732

This vulnerability affects a WordPress plugin which is designed to be public-facing by default. The vulnerable AJAX endpoint is accessible to unauthenticated users, meaning the attack surface is exposed directly on the public internet as part of the standard deployment of any website using this plugin.

Missing Authentication

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in the WP Maps Pro WordPress plugin, affecting all versions prior to 6.1.0. This issue allows unauthenticated attackers to create a new administrator account on a WordPress site, potentially leading to a complete takeover of the website. The vulnerability is exploitable remotely without any user interaction.

Attackers can create admin accounts on WordPress sites.
Site takeover is possible if the plugin is in use.
Confirm plugin relevance and verify exposure on your sites.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can create a new administrator account on a WordPress site by exploiting a flaw in the WP Maps Pro plugin. The attacker triggers this by sending a request to a specific AJAX action, bypassing security checks due to a hardcoded nonce. This grants them immediate administrative access, enabling a complete site takeover.

Publicly accessible AJAX endpoint.
Unconditional administrator account creation.
Complete website control.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, unauthenticated attackers could create new administrator accounts on a WordPress site, potentially leading to a complete site takeover.

Administrator user accounts.
Unauthenticated AJAX action and nonce bypass.
Complete WordPress site takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

The WP Maps Pro plugin's privilege escalation vulnerability requires immediate attention from teams managing WordPress sites. The first step is to identify all instances of the affected plugin, determine their exposure, and confirm the business criticality of each site. Once identified, the accountable owner for each site or instance must be located to plan and execute remediation.

WordPress site owners should own the issue.
Verify plugin presence and public accessibility.
Plan remediation based on site criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WP Maps Pro plugin used for?

WP Maps Pro is an add-on for WordPress websites designed to integrate and display advanced Google Maps features. It allows site administrators to embed custom map markers, routes, and interactive location data directly into their web pages, which requires the plugin to load various scripts and handle AJAX requests on the frontend of the site.

How does CVE-2026-8732 cause a security issue?

This vulnerability is classified as CWE-306, which refers to Missing Authentication for Critical Function. In this case, the plugin provides an AJAX action intended for specific tasks, but it fails to verify the identity of the person making the request. Because the security token required to authorize the action is publicly visible on the site, the system incorrectly treats anonymous visitors as authorized users, allowing them to perform administrative functions.

Can I trigger this vulnerability if I am already logged in?

Yes, but the vulnerability does not require any existing login or specific user account to function. The flaw specifically resides in a handler designed to accept requests from unauthenticated users. It does not depend on a user being logged in to trigger the creation of an administrator account; rather, it bypasses the need for authentication entirely by using a publicly available security token.

Why is this plugin considered high risk for internet-facing sites?

According to Halo Surface Signal, this plugin is inherently designed to be public-facing to serve maps to visitors. Because the vulnerable endpoint is accessible to any user visiting the site over the internet, no special permissions are needed to reach the code path that creates an administrator account. This makes it an external-facing risk for any WordPress site that has the plugin active and accessible to the public.

What should I do if my site uses WP Maps Pro?

First, confirm if the plugin is installed and active on your WordPress instances. Once you have identified all affected sites, evaluate their role and business importance to prioritize your response. Ensure you coordinate with the site owners to plan necessary updates or remediation steps to secure your installation against unauthorized account creation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.