WP Maps Pro flaw (CVE-2026-8732) exploited, update to 6.1.1

A critical security flaw in a popular WordPress plugin is being actively exploited, allowing attackers to create administrator accounts and take full control of affected websites. The vulnerability, tracked as CVE-2026-8732, exists in the WP Maps Pro plugin, a premium tool used by over 15,000 sites to create customizable maps and store locators.

The flaw is a privilege escalation vulnerability that enables unauthenticated attackers—anyone on the internet—to create a new WordPress user with full administrator privileges. Security researchers explain that the issue stems from a "temporary access" feature intended to let plugin support staff log into a customer's site for troubleshooting. This feature registered an AJAX action that was accessible without authentication and protected only by a security nonce that was publicly exposed on every frontend page of a website.

By exploiting this misconfigured endpoint, an attacker can trigger a function that creates a new administrator account with a randomly generated username and a hardcoded email address. The function then returns a unique "magic login" URL. Visiting this URL automatically authenticates the attacker as the newly created...