Threat reportVulnerabilityTL-2026-0635
WP Maps Pro CVE-2026-8732 — Unauthenticated Rogue Administrator Creation via Temporary-Access AJAX Endpoint (Active Exploitation)
WP Maps Pro CVE-2026-8732 (TL-2026-0635) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-05-31. It has no confirmed attribution, affects FlipperCode WP Maps Pro (WordPress plugin), references 1 CVE (CVE-2026-8732), maps to 11 MITRE ATT&CK techniques (T1059, T1078, T1098), and is covered by 9 detection rules and 13 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 11MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 13Indicators of compromise
Key facts for TL-2026-0635
- Threat ID
- TL-2026-0635
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, small-business, e-commerce, retail, media, hospitality
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 13
How WP Maps Pro CVE-2026-8732 works
CVE-2026-8732 is a critical (CVSS 9.8) unauthenticated broken-access-control flaw in the WP Maps Pro WordPress plugin (versions <= 6.1.0). The plugin's 'temporary access' AJAX handler (wpgmp_temp_access_ajax) was registered for unauthenticated users via wp_ajax_nopriv_ and protected only by a nonce publicly embedded in frontend JavaScript. A crafted request with check_temp=false invokes wp_insert_user() to create a hardcoded-administrator account and returns a passwordless magic-login URL, granting full WordPress site takeover. Defiant/Wordfence observed active exploitation, blocking 3,600+ attempts in 24 hours. Fixed in 6.1.1.
WP Maps Pro is a commercial WordPress store-locator / Google Maps plugin developed by FlipperCode with over 15,800 sales on Envato Market. CVE-2026-8732 is a critical unauthenticated broken-access-control / missing-authorization vulnerability affecting all versions up to and including 6.1.0.
ROOT CAUSE: The plugin ships a 'temporary access' support feature intended to let vendor support staff obtain time-limited administrative access for troubleshooting. The corresponding AJAX action, wpgmp_temp_access_ajax, was registered through both wp_ajax_ (authenticated) and wp_ajax_nopriv_ (unauthenticated) hooks, exposing the wpgmp_temp_access_ajax_callback() handler to any anonymous visitor. The only gate was a nonce (fc-call-nonce) that the plugin itself published into every frontend page via wp_localize_script(), so any unauthenticated attacker could scrape a valid nonce from public HTML and satisfy the check. The handler performed no current_user_can() capability check.
EXPLOIT CHAIN: (1) Initial access — the attacker requests any public page of the target site and extracts the fc-call-nonce value embedded by wp_localize_script. (2) Trigger — the attacker POSTs to /wp-admin/admin-ajax.php with action=wpgmp_temp_access_ajax, the harvested nonce, and the parameter check_temp=false. Setting check_temp to false bypasses the intended temporary-grant validation branch and falls through to unconditional account creation. (3) Privilege escalation — the handler calls wp_insert_user() with a hardcoded 'administrator' role, a randomly generated username following the fc_user_<uniqid()> pattern, and a hardcoded vendor support email (support@flippercode.com). (4) Authentication bypass — generate_login_link() builds a magic-login URL that, when visited, calls wp_set_auth_cookie() for the new administrator with no password or secondary verification, returning the URL directly in the AJAX response body. (5) Post-exploitation — once authenticated as administrator, the attacker has full control: installing malicious plugins, uploading webshells/backdoors, modifying themes (e.g., functions.php), creating additional persistence accounts, exfiltrating data, and pivoting to the underlying host.
ACTIVE EXPLOITATION: Defiant/Wordfence reported blocking more than 3,600 exploitation attempts within a 24-hour window. The flaw was reported to the Wordfence Bug Bounty Program by researcher David Brown on 2026-03-24 (earning a $1,950 bounty); FlipperCode was notified on 2026-05-16 after exploit validation, Wordfence deployed firewall rules to Premium/Care/Response customers on 2026-05-18, the patched version 6.1.1 was released on 2026-05-20, and public disclosure followed on 2026-05-29 with free-tier firewall protection scheduled for 2026-06-17.
REMEDIATION: The 6.1.1 patch adds a current_user_can('manage_options') capability check to the handler, restricting the feature to authenticated administrators. Defenders should update immediately and hunt for indicators of prior compromise: unexpected administrator accounts (especially usernames matching fc_user_*), users registered with support@flippercode.com or support@wpmaps.pro, and admin-ajax.php access-log entries containing action=wpgmp_temp_access_ajax with check_temp=false.
NOTE: One downstream republication listed the hardcoded account email as support@wpmaps.pro rather than support@flippercode.com; both values are included as IOCs to ensure detection coverage regardless of plugin build.
MITRE ATT&CK techniques used in TL-2026-0635
Execution
T1059 Command and Scripting Interpreter
Privilege Escalation
T1078 Valid Accounts; T1098 Account Manipulation
Persistence
T1136 Create Account; T1505 Server Software Component
Initial Access
T1190 Exploit Public-Facing Application
Collection
T1213 Data from Information Repositories
Impact
Credential Access
T1539 Steal Web Session Cookie
Reconnaissance
Affected products and versions in WP Maps Pro CVE-2026-8732
- FlipperCode — WP Maps Pro (WordPress plugin)
Vulnerable versions: <= 6.1.0
Fixed in: 6.1.1
Remediation for WP Maps Pro CVE-2026-8732
Patches
- WP Maps Pro 6.1.1 (released 2026-05-20) adds a current_user_can('manage_options') capability check to the wpgmp_temp_access_ajax handler
Immediate actions
- Update WP Maps Pro to version 6.1.1 or later on all WordPress sites immediately
- Audit all WordPress administrator accounts and delete any unrecognized users, especially usernames matching the fc_user_* pattern
- Search the users table for accounts registered with support@flippercode.com or support@wpmaps.pro and remove them
- Force a password reset and re-authentication of all legitimate administrator accounts; invalidate active sessions/auth cookies
- Block POST requests to admin-ajax.php with action=wpgmp_temp_access_ajax and check_temp=false at the WAF/perimeter
Workarounds
- If immediate patching is not possible, disable/deactivate the WP Maps Pro plugin until updated
- Deny unauthenticated access to action=wpgmp_temp_access_ajax via web-server rules or WAF
Longer-term hardening
- Deploy a WordPress-aware WAF (Wordfence or equivalent) with virtual patching for plugin vulnerabilities
- Implement file-integrity monitoring on wp-content (plugins, themes, uploads) to detect webshells and backdoors
- Establish alerting on new administrator account creation and role changes via security/audit logging
- Adopt a least-privilege plugin governance process and remove unused/abandoned plugins
CVEs associated with WP Maps Pro CVE-2026-8732
Weaknesses (CWE) in WP Maps Pro CVE-2026-8732
Timeline of WP Maps Pro CVE-2026-8732
- Researcher David Brown reports the unauthenticated admin-creation flaw to the Wordfence Bug Bounty Program (later awarded a $1,950 bounty).
- FlipperCode (vendor) is notified after Wordfence validates the exploit; issue escalated to the Envato security team.
- Wordfence deploys firewall rules protecting Premium, Care, and Response customers against exploitation.
- WP Maps Pro 6.1.1 released, adding a current_user_can('manage_options') capability check to the temporary-access AJAX handler.
- Vulnerability publicly disclosed and assigned CVE-2026-8732 (CVSS 9.8).
- Defiant/Wordfence report blocking 3,600+ exploitation attempts within a 24-hour period; mass exploitation in the wild confirmed.
- Scheduled activation of firewall protection for Wordfence free-tier users.
Sources cited for WP Maps Pro CVE-2026-8732
- WP Maps Pro bug exploited to create admin accounts on WordPress sites
- 15,000 WordPress Sites Affected by Administrator Account Creation Vulnerability in WP Maps Pro (Wordfence)
- WP Maps Pro Flaw Exposed Sites To Administrator Takeover
- WP Maps Pro Flaw Lets Attackers Create Admin Accounts on 15K Sites
- Critical Vulnerability in WP Maps Pro: What You Need to Know
- CVE-2026-8732 — Critical Vulnerability
- NVD — CVE-2026-8732
Detection coverage for TL-2026-0635
As of 2026-05-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0635 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.