# WP Maps Pro CVE-2026-8732 — Unauthenticated Rogue Administrator Creation via Temporary-Access AJAX Endpoint (Active Exploitation)

> CVE-2026-8732 is a critical (CVSS 9.8) unauthenticated broken-access-control flaw in the WP Maps Pro WordPress plugin (versions <= 6.1.0). The plugin's 'temporary access' AJAX handler (wpgmp_temp_access_ajax) was registered for unauthenticated users via wp_ajax_nopriv_ and protected only by a nonce publicly embedded in frontend JavaScript. A crafted request with check_temp=false invokes wp_insert_user() to create a hardcoded-administrator account and returns a passwordless magic-login URL, granting full WordPress site takeover. Defiant/Wordfence observed active exploitation, blocking 3,600+ attempts in 24 hours. Fixed in 6.1.1.

- **Published:** 2026-05-31T00:00:00Z
- **Last reviewed:** 2026-05-31T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0635
- **ID:** TL-2026-0635
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-8732

## Description

WP Maps Pro is a commercial WordPress store-locator / Google Maps plugin developed by FlipperCode with over 15,800 sales on Envato Market. CVE-2026-8732 is a critical unauthenticated broken-access-control / missing-authorization vulnerability affecting all versions up to and including 6.1.0.

ROOT CAUSE: The plugin ships a 'temporary access' support feature intended to let vendor support staff obtain time-limited administrative access for troubleshooting. The corresponding AJAX action, wpgmp_temp_access_ajax, was registered through both wp_ajax_ (authenticated) and wp_ajax_nopriv_ (unauthenticated) hooks, exposing the wpgmp_temp_access_ajax_callback() handler to any anonymous visitor. The only gate was a nonce (fc-call-nonce) that the plugin itself published into every frontend page via wp_localize_script(), so any unauthenticated attacker could scrape a valid nonce from public HTML and satisfy the check. The handler performed no current_user_can() capability check.

EXPLOIT CHAIN: (1) Initial access — the attacker requests any public page of the target site and extracts the fc-call-nonce value embedded by wp_localize_script. (2) Trigger — the attacker POSTs to /wp-admin/admin-ajax.php with action=wpgmp_temp_access_ajax, the harvested nonce, and the parameter check_temp=false. Setting check_temp to false bypasses the intended temporary-grant validation branch and falls through to unconditional account creation. (3) Privilege escalation — the handler calls wp_insert_user() with a hardcoded 'administrator' role, a randomly generated username following the fc_user_<uniqid()> pattern, and a hardcoded vendor support email (support@flippercode.com). (4) Authentication bypass — generate_login_link() builds a magic-login URL that, when visited, calls wp_set_auth_cookie() for the new administrator with no password or secondary verification, returning the URL directly in the AJAX response body. (5) Post-exploitation — once authenticated as administrator, the attacker has full control: installing malicious plugins, uploading webshells/backdoors, modifying themes (e.g., functions.php), creating additional persistence accounts, exfiltrating data, and pivoting to the underlying host.

ACTIVE EXPLOITATION: Defiant/Wordfence reported blocking more than 3,600 exploitation attempts within a 24-hour window. The flaw was reported to the Wordfence Bug Bounty Program by researcher David Brown on 2026-03-24 (earning a $1,950 bounty); FlipperCode was notified on 2026-05-16 after exploit validation, Wordfence deployed firewall rules to Premium/Care/Response customers on 2026-05-18, the patched version 6.1.1 was released on 2026-05-20, and public disclosure followed on 2026-05-29 with free-tier firewall protection scheduled for 2026-06-17.

REMEDIATION: The 6.1.1 patch adds a current_user_can('manage_options') capability check to the handler, restricting the feature to authenticated administrators. Defenders should update immediately and hunt for indicators of prior compromise: unexpected administrator accounts (especially usernames matching fc_user_*), users registered with support@flippercode.com or support@wpmaps.pro, and admin-ajax.php access-log entries containing action=wpgmp_temp_access_ajax with check_temp=false.

NOTE: One downstream republication listed the hardcoded account email as support@wpmaps.pro rather than support@flippercode.com; both values are included as IOCs to ensure detection coverage regardless of plugin build.

## MITRE ATT&CK

- T1595 Active Scanning
- T1593 Search Open Websites/Domains
- T1190 Exploit Public-Facing Application
- T1136 Create Account
- T1505 Server Software Component
- T1078 Valid Accounts
- T1098 Account Manipulation
- T1539 Steal Web Session Cookie
- T1059 Command and Scripting Interpreter
- T1213 Data from Information Repositories
- T1491 Defacement

## Sources

- [WP Maps Pro bug exploited to create admin accounts on WordPress sites](https://www.bleepingcomputer.com/news/security/wp-maps-pro-bug-exploited-to-create-admin-accounts-on-wordpress-sites/)
- [15,000 WordPress Sites Affected by Administrator Account Creation Vulnerability in WP Maps Pro (Wordfence)](https://malware.news/t/15-000-wordpress-sites-affected-by-administrator-account-creation-vulnerability-in-wp-maps-pro-wordpress-plugin/107402)
- [WP Maps Pro Flaw Exposed Sites To Administrator Takeover](https://thecyberexpress.com/wp-maps-pro-vulnerability/)
- [WP Maps Pro Flaw Lets Attackers Create Admin Accounts on 15K Sites](https://www.webmastered.com/blog/wp-maps-pro-vulnerability-admin-account-creation/)
- [Critical Vulnerability in WP Maps Pro: What You Need to Know](https://bitninja.com/blog/critical-vulnerability-in-wp-maps-pro-what-you-need-to-know/)
- [CVE-2026-8732 — Critical Vulnerability](https://www.thehackerwire.com/vulnerability/CVE-2026-8732/)
- [NVD — CVE-2026-8732](https://nvd.nist.gov/vuln/detail/CVE-2026-8732)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0635