Quick Look: CVE-2026-8732 — Unauthenticated Admin Account Creation in WP Maps Pro Plugin

Introduction

A single unauthenticated HTTP request is all it takes to create a full administrator account on any WordPress site running WP Maps Pro version 6.1.0 or earlier. The vulnerability, tracked as CVE-2026-8732 with a CVSS score of 9.8, turns a "temporary support access" feature into an open door for complete site takeover, with no credentials required.

WP Maps Pro is a premium WordPress plugin developed by Flipper Code (also known as WePlugins) that provides store locator functionality, custom map creation, and integration with Google Maps, OpenStreetMap, and MapBox. Sold exclusively through CodeCanyon with over 19,400 sales, it holds a meaningful share of the WordPress mapping plugin market. Its free counterpart, WP Maps, is distributed through the WordPress.org plugin repository, which gives the Flipper Code mapping ecosystem a broad footprint across WordPress installations.

Technical Information

Root Cause: CWE-306 and the Nonce Misconception

CVE-2026-8732 falls under CWE-306: Missing Authentication for Critical Function. The core issue is an AJAX handler that creates an administrator account without any authentication or authorization check. The only gate is a WordPress nonce, and that nonce is publicly available on every page of the site.

WordPress nonces are CSRF protection tokens. They verify that a request came from a page on the site. They do not verify the identity or authorization level of the requester. When a nonce is embedded in frontend markup visible to all visitors, it provides zero access control value.

The Vulnerable AJAX Handler

The plugin registers the wpgmp_temp_access_ajax AJAX action using the wp_ajax_nopriv_ hook prefix. In WordPress, this prefix explicitly designates the handler as accessible to unauthenticated users. Any visitor, logged in or not, can invoke this handler by sending a POST request to wp-admin/admin-ajax.php with the action parameter set to wpgmp_temp_access_ajax.

The handler verifies a nonce using the fc-call-nonce value. But this nonce is embedded into every frontend page via wp_localize_script as the nonce field of the wpgmp_local JavaScript object. An attacker can extract this value by viewing the page source of any page on the target site.

Exploitation Flow

The attack chain is straightforward and can be run with nothing more than a browser or a curl command:

Step 1: Obtain the nonce. The attacker visits any page on the target WordPress site and extracts the fc-call-nonce value from the wpgmp_local JavaScript object in the page source. The plugin injects this object into every frontend page via wp_localize_script.

Step 2: Send the AJAX request. The attacker sends a POST request to wp-admin/admin-ajax.php with the following parameters:

• action set to wpgmp_temp_access_ajax
• The extracted nonce value
• check_temp set to false

Setting check_temp=false causes the wpgmp_temp_access_support handler to skip the temporal validation that might otherwise limit when the feature can be used. The attacker controls the parameter, so this bypass is trivial.

Step 3: Administrator account is created. The handler calls wp_insert_user() with a hardcoded role of administrator. There is no capability check, no role validation, and no configuration option that limits the role. Every successful invocation creates a full administrator account.

Step 4: Magic login URL is returned. The handler responds with a "magic login URL." When the attacker visits this URL, WordPress calls wp_set_auth_cookie(), which establishes a fully authenticated administrator session. No password is needed, and no login form interaction is required. The attacker has immediate, persistent administrative access to the entire WordPress installation.

Why This Is Particularly Dangerous

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H captures the severity: network accessible, low complexity, no privileges required, no user interaction needed, and complete impact across confidentiality, integrity, and availability. The whole exploitation chain can be automated trivially, which puts it within reach of automated scanning tools and low-skill threat actors operating at scale.

The feature seems to have been designed as a temporary support access mechanism, probably to let plugin support staff log into a customer's site for troubleshooting. The implementation exposes that capability to the entire internet with no meaningful access control.

Affected Systems and Versions

Any WordPress site running WP Maps Pro version 6.1.0 or earlier is vulnerable, regardless of WordPress version or server configuration. The vulnerability does not require any specific plugin settings or configurations to be exploitable. The vulnerable AJAX endpoint is active by default once the plugin is installed and activated.

Because WP Maps Pro is distributed through CodeCanyon rather than the WordPress.org repository, sites do not get WordPress's built-in auto-update mechanism. Plugin updates must be downloaded and installed manually from the CodeCanyon marketplace, which historically results in slower patch adoption.

Vendor Security History

Flipper Code's mapping plugin family has a documented pattern of authorization-related vulnerabilities:

Both CVE-2025-39465 and CVE-2026-8732 share the same root CWE (CWE-306), which points to a systemic weakness in how the vendor implements authorization controls. The earlier vulnerability let authenticated attackers with Subscriber-level access perform unauthorized actions. CVE-2026-8732 is a far more severe version of the same design flaw, escalating from authenticated to completely unauthenticated exploitation with maximum privilege gain.

The free counterpart plugin, WP Go Maps (formerly WP Google Maps), has 23 documented vulnerabilities on Wordfence, including unauthenticated stored cross-site scripting, SQL injection, and multiple authorization bypass issues. Organizations using any Flipper Code mapping plugin should audit their entire mapping plugin footprint and decide whether the risk profile fits their security requirements.

Mitigation Recommendations

Upgrade immediately. The fix is upgrading to WP Maps Pro version 6.1.1 or later. Given the trivial exploitation complexity and maximum impact, treat this as an emergency patching priority.

If patching is not immediately possible, deactivate the plugin. Removing the active plugin eliminates the vulnerable AJAX endpoint entirely. This is the most reliable compensating control short of patching.

Deploy WAF rules. Web application firewalls can be configured to block POST requests to wp-admin/admin-ajax.php containing action=wpgmp_temp_access_ajax. Wordfence Premium includes firewall rules designed to block attacks against known WordPress plugin vulnerabilities.

Audit for compromise indicators. After patching, review all WordPress administrator accounts for entries that were not intentionally created. Specific indicators to look for:

• Administrator accounts with unfamiliar usernames or recent creation dates
• POST requests in server logs to wp-admin/admin-ajax.php containing action=wpgmp_temp_access_ajax and check_temp=false
• Authentication cookies or active sessions for unrecognized user accounts

If you find any indicators of compromise, assume full site takeover and run a thorough incident response, including reviewing all site content, checking for backdoors, and resetting all user credentials.

Evaluate long-term plugin strategy. Given the recurring CWE-306 pattern in this plugin's history, organizations with strict security requirements should consider migrating to an alternative mapping plugin with a stronger security track record.

Threat Landscape Context

As of May 29, 2026, no confirmed active exploitation of CVE-2026-8732 has been reported. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog. But it was publicly disclosed less than 24 hours ago, and several characteristics make it a strong candidate for near-term weaponization.

Exploitation requires no authentication, no user interaction, no special tools, and no exploit development expertise. A single HTTP POST with publicly obtainable parameters is enough. That puts it well within reach of automated scanning botnets that routinely target WordPress plugin vulnerabilities at scale.

Historical precedent supports this assessment. The Patchstack State of WordPress Security in 2026 report describes privilege escalation flaws as among the most commonly exploited vulnerability categories in the WordPress ecosystem. A comparable vulnerability in the Modular DS Connector plugin (CVE-2026-23550), which also allowed unauthenticated admin account creation, was reported to put approximately 40,000 WordPress sites at risk.

The CodeCanyon distribution model compounds the risk. Unlike plugins hosted on WordPress.org, CodeCanyon plugins do not get WordPress's built-in update notifications and auto-update features. So the window between patch availability and actual patch adoption is likely to be much longer, giving threat actors more time to exploit unpatched installations.

References

• NVD Entry for CVE-2026-8732
• Wordfence Advisory: WP Maps Pro <= 6.1.0 Unauthenticated Privilege Escalation
• Wordfence Vulnerability Database: WP Maps Pro
• CodeCanyon Listing: Store Locator for WordPress
• CWE-306: Missing Authentication for Critical Function
• Wordfence Advisory: Advanced Google Maps <= 5.8.4 Missing Authorization (CVE-2025-39465)
• Wordfence Vulnerability Database: WP Go Maps
• Patchstack: State of WordPress Security in 2026
• CISA Known Exploited Vulnerabilities Catalog
• WordPress.org: WP Maps Plugin
• Wordfence Intelligence