A critical unauthenticated privilege escalation vulnerability in WP Maps Pro, a widely used WordPress mapping plugin with over 15,000 sales on CodeCanyon, is being actively exploited by threat actors to create rogue administrator accounts.
Tracked as CVE-2026-8732, the flaw carries a maximum CVSS score of 9.8 (Critical) and affects all plugin versions up to and including 6.1.0.
The vulnerability originates in the plugin’s built-in “temporary access” feature, which allows vendor staff to log in to customer sites during troubleshooting sessions.
Critical WP Maps Pro Vulnerability
The AJAX action wpgmp_temp_access_ajax was registered using WordPress’s wp_ajax_nopriv_ hook making it accessible to completely unauthenticated users and was guarded only by a nonce check.
Critically, that nonce (fc-call-nonce) is publicly embedded into every frontend page of the site via wp_localize_script, rendering the protection entirely ineffective as an access control mechanism.
The weakness is classified under CWE-306 (Missing Authentication for Critical Function), with a full network-based attack vector requiring no privileges and no user interaction.
By sending a POST request to the exposed AJAX endpoint with the parameter check_temp=false, an attacker triggers the wpgmp_temp_access_support() function.
This function unconditionally calls WordPress’s wp_insert_user() to create a new account with a hardcoded administrator role, a randomly generated username prefixed with fc_user_, and the hardcoded email address support@flippercode.com.
The function then generates a “magic login URL” and returns it directly in the HTTP response body.
When the attacker visits that URL, the plugin calls wp_set_auth_cookie() to fully authenticate them as the new administrator no password or further verification required, Wordfence said.
Active exploitation of this flaw has already been reported in the wild, with attackers leveraging admin access to install malicious plugins, inject persistent backdoors, deploy web shells, exfiltrate sensitive data, and modify site content.
Security researcher David Brown responsibly reported the flaw through the Wordfence Bug Bounty Program on March 24, 2026.
Because no direct contact with the vendor was available, Wordfence escalated to the Envato security team on May 16, 2026, who forwarded the report to the developer.
A fully patched version, 6.1.1, was released on May 20, 2026, with the fix adding a current_user_can('manage_options') capability check at the top of the AJAX callback function, immediately rejecting unauthenticated requests with a 403 Unauthorized error before any account creation logic can execute.
Mitigation
- Update WP Maps Pro to version 6.1.1 immediately
- Audit all WordPress administrator accounts and remove any suspicious entries with usernames beginning with
fc_user_or using the emailsupport@flippercode.com - Review server and access logs for unusual POST requests targeting the
wpgmp_temp_access_ajaxAJAX action - Deploy a Web Application Firewall (WAF) to block exploitation attempts while patches are applied across all instances.
Given the zero-authentication barrier to exploitation, a publicly available PoC, and confirmed active exploitation, CVE-2026-8732 must be treated as an emergency patch priority for any site running WP Maps Pro.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
