WordPress plugins are handy, expanding a site’s functionality
with just a few clicks, and are precisely for this reason a popular point of entry. With
CVE-2026-8732 is a critical vulnerability in the widely used WP Maps
Pro plugin that has come to light, demonstrating how a single poorly secured
interface is enough to result in the complete loss of a website.
What is CVE-2026-8732?
CVE-2026-8732 is a critical vulnerability in the WordPress plugin
WP Maps Pro by the manufacturer flippercode; all versions up to and including 6.1.0 are affected. The vulnerability was published on 29 May 2026 by
Wordfence and assigned a CVSS score of 9.8 (critical)
. It is categorised as CWE-306 (Missing Authentication for Critical Function).
The result: an unauthenticated attacker can create an administrator account for themselves
and thereby gain full control over the site.
The vulnerability in detail
Essentially, it concerns the AJAX action wpgmp_temp_access_ajax.
This is registered via wp_ajax_nopriv_ , meaning it is deliberately accessible even to
unregistered visitors. The only protective measure in place is an
assessment of the nonce fc-call-nonce. The problem is that this very same
nonce is wp_localize_script embedded in every front-end page
and is therefore publicly readable by anyone.
A nonce is intended to distinguish valid requests from forged ones, but not to restrict access. As soon as the value is included on every public page, it is no longer a secret. The supposed security measure is therefore completely ineffective, and the critical function is effectively exposed without any authentication.
How the attack works
Reading the nonce
The attacker visits any public page and
reads the freely provided nonce from the JavaScript object
wpgmp_local .
Call the AJAX endpoint
Using this nonce, they send a single HTTP POST request to the
open endpoint and call the handler
wpgmp_temp_access_support with
check_temp=false .
Admin account is created
The handler uses wp_insert_user() unconditionally
creates a new user with the hard-coded role of
administrator.
Obtaining the magic login URL
The function returns a login URL as a response. If this is accessed, it wp_set_auth_cookie() a
valid session for the new account.
Complete takeover
The attacker is now logged in as an administrator and
controls content, settings, user accounts and, consequently,
the entire website.
How dangerous is this really?
The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H sums it up: the attack is carried out via the network, is technically simple,
requires no privileges and no user interaction, and has a full impact on
confidentiality, integrity and availability. Even though the vulnerability
is currently neither listed in the KEV nor has a significant EPSS score,
it is considered automatable with ‘total’ technical impact. Anyone
operating a vulnerable system should not wait for the first
widespread attack.
Quick check: Is WP Maps Pro installed on your site?
If so, check the version under Plugins. All versions up to and including 6.1.0 are considered vulnerable. If in doubt, it’s better to check once too often than once too little.
What you should do now
At the time of publication, there was no official patch or
workaround available from the manufacturer. Therefore, do not rely solely on
an update, but actively reduce your attack surface and check whether the
vulnerability has already been exploited.
Update or disable
Install a fixed version provided by the manufacturer
immediately. If its availability has not yet been achieved, temporarily disable or remove the
plugin.
Audit accounts
Check all WordPress users for unknown administrators and
delete any account that you did not create yourself.
Secure & monitor
Blocks the vulnerable endpoint via a web application Firewall,
renews keys and sessions, and keeps an eye on logins and new
users.
accessible function that holds a public value for an
access control mechanism is enough to lose an entire site.”
Mint Secure GmbH
How Mint Secure supports you
A single CVE is rarely an isolated incident. Often, a single
WordPress installation harbours several outdated plugins, unused extensions
and unclear access rights all at once. This is precisely where we step in to help
you realistically assess your attack surface and sustainably reduce it.
Assessment
We provide you with an overview of the plugins in use,
their version numbers and known vulnerabilities, so that you know where you’re
truly vulnerable.
Incident Check
If a compromise is suspected, we check accounts, logs and
files for traces and assist with a clean
recovery.
Ongoing Protection
With patch management, Monitoring and clear processes, we ensure
that the next critical CVE doesn’t catch you off guard.
Not sure if you’re affected? We’ll take a look together at your WordPress environment and give you an honest assessment of whether there’s an urgent need for action and what the next sensible step is.
Get in touch.
Conclusion
CVE-2026-8732 is a cautionary tale of how a well-intentioned convenience feature
can become a critical vulnerability when a public value is mistaken for genuine
access control. For affected sites, the risk is at its highest: complete takeover without login, automatable and with a single request. Anyone using WP Maps Pro should check their version immediately, reduce their attack surface and review their own
administrator accounts. Mint Secure is here to support you,
whether you’re dealing with an immediate suspected incident or seeking to ensure long-term security for your
WordPress installations.
Talk to us.
