WP Maps Pro CVE-2026-8732 — Unauthenticated Rogue Administrator Creation via Temporary-Access AJAX Endpoint (Active Exploitation) — Threadlinqs Intelligence
As of 2026-05-31, WP Maps Pro CVE-2026-8732 — Unauthenticated Rogue Administrator Creation via Temporary-Access AJAX Endpoint (Active Exploitation) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 13 indicators of compromise.
Threat ID: TL-2026-0635 · Severity: CRITICAL · CVSS: 9.8 · Status: ACTIVE · Category: VULNERABILITY
CVE-2026-8732 is a critical (CVSS 9.8) unauthenticated broken-access-control flaw in the WP Maps Pro WordPress plugin (versions <= 6.1.0). The plugin's 'temporary access' AJAX handler
WP Maps Pro is a commercial WordPress store-locator / Google Maps plugin developed by FlipperCode with over 15,800 sales on Envato Market. CVE-2026-8732 is a critical unauthenticated broken-access-control / missing-authorization vulnerability affecting all versions up to and including 6.1.0.
ROOT CAUSE: The plugin ships a 'temporary access' support feature intended to let vendor support staff obtain time-limited administrative access for troubleshooting. The corresponding AJAX action, wpgmp_temp_access_ajax, was registered through both wp_ajax_ (authenticated) and wp_ajax_nopriv_ (unauthenticated) hooks, exposing the wpgmp_temp_access_ajax_callback() handler to any anonymous visitor. The only gate was a nonce (fc-call-nonce) that the plugin itself published into every frontend page via wp_localize_script(), so any unauthenticated attacker could scrape a valid nonce from public HTML and satisfy the check. The handler performed no current_user_can() capability check.
EXPLOIT CHAIN: (1) Initial access — the attacker requests any public page of the target site and extracts the fc-call-nonce value embedded by wp_localize_script. (2) Trigger — the attacker POSTs to /wp-admin/admin-ajax.php with action=wpgmp_temp_access_ajax, the harvested nonce, and the parameter check_temp=false. Setting check_temp to false bypasses the intended temporary-grant validation branch and falls through to unconditional account creation. (3) Privilege escalation — the handler calls wp_insert_user() with a hardcoded 'administrator' role, a randomly generated username following the fc_user_<uniqid()> pattern, and a hardcoded vendor support email (support@flippercode.com). (4) Authentication bypass — generate_login_link() builds a magic-login URL that, when visited, calls wp_set_auth_cookie() for the new administrator with no password or secondary verification, returning the URL directly in the AJAX response body. (5) Post-exploitation — once authenticated as administrator, the attacker has full control: installing malicious plugins, uploading webshells/backdoors, modifying themes (e.g., functions.php), creating additional persistence accounts, exfiltrating data, and pivoting to the underlying host.
ACTIVE EXPLOITATION: Defiant/Wordfence reported blocking more than 3,600 exploitation attempts within a 24-hour window. The flaw was reported to the Wordfence Bug Bounty Program by researcher David Brown on 2026-03-24 (earning a $1,950 bounty); FlipperCode was notified on 2026-05-16 after exploit validation, Wordfence deployed firewall rules to Premium/Care/Response customers on 2026-05-18, the patched version 6.1.1 was released on 2026-05-20, and public disclosure followed on 2026-05-29 with free-tier firewall protection scheduled for 2026-06-17.
REMEDIATION: The 6.1.1 patch adds a current_user_can('manage_options') capability check to the handler, restricting the feature to authenticated administrators. Defenders should update immediately and hunt for indicators of prior compromise: unexpected administrator accounts (especially usernames matching fc_user_*), users registered with support@flippercode.com or support@wpmaps.pro, and admin-ajax.php access-log entries containing action=wpgmp_temp_access_ajax with check_temp=false.
NOTE: One downstream republication listed the hardcoded account email as support@wpmaps.pro rather than support@flippercode.com; both values are included as IOCs to ensure detection coverage regardless of plugin build.
Weaknesses (CWE)
CWE-862, CWE-269, CWE-306
Target sectors: technology, small-business, e-commerce, retail, media, hospitality
Target regions: Global
Timeline
- Researcher David Brown reports the unauthenticated admin-creation flaw to the Wordfence Bug Bounty Program (later awarded a $1,950 bounty).
- FlipperCode (vendor) is notified after Wordfence validates the exploit; issue escalated to the Envato security team.
- Wordfence deploys firewall rules protecting Premium, Care, and Response customers against exploitation.
- WP Maps Pro 6.1.1 released, adding a current_user_can('manage_options') capability check to the temporary-access AJAX handler.
- Vulnerability publicly disclosed and assigned CVE-2026-8732 (CVSS 9.8).
- Defiant/Wordfence report blocking 3,600+ exploitation attempts within a 24-hour period; mass exploitation in the wild confirmed.
- Scheduled activation of firewall protection for Wordfence free-tier users.
Detections & IOCs
As of 2026-08-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 13 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-8732, T1595, T1593, T1190, T1136, T1505, T1078, T1098, T1539, T1059, T1213
