Hackers are actively targeting WordPress websites using a vulnerable version of the WP Maps Pro plugin, a critical security flaw that can let attackers create rogue administrator accounts without logging in.
The vulnerability, tracked as CVE-2026-8732, affects WP Maps Pro version 6.1.0 and older. It was discovered and reported by security researcher David Brown. WP Maps Pro is a premium WordPress plugin used to create interactive and customizable maps, store locators, and location-based directories. It supports popular map providers such as Google Maps and OpenStreetMap and is commonly used by businesses, real estate platforms, travel websites, directories, and organizations that need to show multiple locations on a map.
The plugin has more than 15,800 sales on Envato Market, making the flaw a serious concern for many WordPress site owners. The issue comes from a “temporary access” feature built into the plugin, which was designed to let vendor support staff access customer websites for troubleshooting.
Brown found that the AJAX endpoint used by this feature could be accessed by unauthenticated users. The protection depended only on a nonce that was publicly exposed in frontend JavaScript, making it ineffective against attackers.
Because of this weakness, a hacker can send a specially crafted request that triggers the plugin to create a new WordPress user with administrator privileges. The request also generates a passwordless login URL and sends it to a remote system. Once the attacker opens that URL, they are automatically logged in as the newly created administrator without needing a password or any other verification.
Researchers at WordPress security firm Defiant said they have already seen active exploitation attempts. According to the company, more than 3,600 attacks targeting the flaw were blocked in the past 24 hours.
Wordfence researchers explained that when the request is made with the check_temp parameter set to false, the function creates a new WordPress user through wp_insert_user(). The new account is given the administrator role, a randomly generated username, and the hardcoded email address [email protected]. The function then creates a “magic login URL,” stores it as user meta, and returns it in the response body.
With administrator access, attackers can fully compromise a WordPress website. They can install malicious plugins, inject backdoors, change website content, access private data, deploy web shells, and take control of the site.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Brown reported the vulnerability to Wordfence on March 24. After the exploit was validated, the vendor was notified on May 16. WP Maps Pro version 6.1.1 was released on May 20 with a fix for CVE-2026-8732. Website administrators using the plugin are strongly advised to update immediately, as attacks are already happening.
