WP Maps Pro for WordPress through version 6.1.0 is affected by CVE-2026-8732. Its temporary support-access AJAX action is registered through wp_ajax_nopriv_, while the nonce used as access control is exposed on front-end pages. An unauthenticated attacker can therefore create an administrator and obtain a magic login URL. Wordfence rates it CVSS v3.1 9.8 CRITICAL.
Vulnerability Overview and Scope of Impact
The Wordfence CNA description identifies versions through 6.1.0 as affected, and the vendor distribution identifies 6.1.1 as fixed. Its structured affected array still says through 6.0.4, an internal record inconsistency. This article uses the safer 6.1.0 affected ceiling and directs administrators to update to 6.1.1 or later.
Specific Impacts and Attack Scenarios
A successful attacker has WordPress administrator access and can add plugins or themes, change content, and access user data. The public CNA does not provide a precise 24-hour attack count, so this article does not assert one.
Immediate Measures Engineers Should Take
Install version 6.1.1 or later and inspect unknown administrators, recent logins, plugins, themes, scheduled tasks, and file changes. Invalidate all administrator sessions and credentials. Blocking PHP execution in uploads is useful general hardening but does not prevent this administrator-creation flaw.
📦