SecurityWeekIonut Arghire
WP Maps Pro bug lets attackers create admin accounts
A critical-severity vulnerability in the WP Maps Pro WordPress plugin (CVE-2026-8732) has been reported, allowing unauthenticated attackers to take over websites by creating administrative accounts. The vulnerability, with a CVSS score of 9.8, affects the AJAX function used for temporary access generation. The nonce check protecting this function is ineffective since it is exposed to unauthenticated users, enabling attackers to create new admin users.
The issue has been patched in version 6.1.1 of the plugin, which adds necessary access checks. Over 1,700 attacks targeting this vulnerability were blocked recently.
Story timeline CVE-2026-8732
Full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Mon 1 Jun · 12:32 UTC | Security Affairs | CVE-2026-8732 flaw in WP Maps Pro lets hackers add admin accounts |
| Mon 1 Jun · 18:41 UTC | SecurityWeek | WP Maps Pro bug lets attackers create admin accounts (this article) |