A critical vulnerability has recently come to light in the WP Maps Pro WordPress plugin that is currently being actively exploited. As a result, unauthenticated parties can create an administrator account on vulnerable WordPress sites, allowing them to completely takeover the site.
The WP Maps Pro privilege escalation exploit has been assigned a CVE number of CVE-2026-8732, and it carries a severity score of 9.8 as assessed by the CVSS. So far, WP Maps Pro has sold more than 15,000 units through the Envato Market, which means that there are a significant number of sites that are using this plugin that need to be updated immediately.
What Is WP Maps Pro
WP Maps Pro provides businesses with the ability to include customizable Google Maps and OpenStreetMap(s) with markers, listings, and enhanced location features on their WordPress sites.
The WP Maps Pro privilege escalation exploit affects any site that uses this plugin as a store locator to help its users find nearby locations, view listing details, and get directions.
Because of the wide use of the WP Maps Pro plugin by businesses that have a physical presence, all sites that are using the WP Maps Pro plugin are vulnerable in some way.
The Vulnerable Feature
The WP Maps Pro privilege escalation exploit is in the temporary-access feature that was designed for WP Maps Pro support personnel to log in to a customer's site while troubleshooting issues.
This feature includes an AJAX action called wpgmp_temp_access_ajax, and it is registered with wp_ajax_nopriv_ which means it can be called by unauthenticated users.
The only protection was a nonce check using the fc-call-nonce nonce, but this nonce is publicly embedded into every frontend page via wp_localize_script as the nonce field of the wpgmp_local JavaScript object.
The WP Maps Pro privilege escalation exploit renders the nonce check completely ineffective because the nonce is not secret at all.
How the Exploit Works
The WP Maps Pro privilege escalation exploit allows unauthenticated attackers to invoke the wpgmp_temp_access_support handler with check_temp=false.
Every time the vulnerability is triggered, a new user with an admin role will be created through wp_insert_user(). When a new user clicks on the magical login link they were sent by the attacker, wp_set_auth_cookie() is called, which logs them in as an admin on the site and allows for full access.
The WP Maps Pro Privilege Escalation Exploit can be executed without requiring: a username, a password, or any pre-existing access to the site.
WP Maps Pro Plugin Patch
WP Maps Pro Plugin Patch was updated on May 20th, 2026 to Version 6.1.1 to fix a vulnerability allowing Privilege Escalation. This update adds a check for the Permalink against any authenticated Administrator account prior to allowing access to the Temporary Access Endpoint.
All users of WP Maps Pro should upgrade as soon as possible to 6.1.1 or higher.
Active Exploitation
There is currently active exploitation of a privilege escalation vulnerability that is being actively used to exploit WP Maps Pro.
WordFence has tracked a large number of attempts to hack into WP Maps Pro through this avenue - they have recorded over 2858 blocking events for these attacks in just the last 24 hours, confirming that hackers are attempting to exploit this Vulnerability as a means of gaining unauthorized access to the WP Maps Pro application.
The WP Maps Pro privilege escalation exploit is now public knowledge, and the number of attacks will likely increase.
Affected Versions
The WP Maps Pro privilege escalation exploit affects all versions of the plugin prior to and including 6.1.0.
Version 6.1.0 and all earlier versions are vulnerable, and version 6.1.1 contains the fix. WP Maps Pro users should check their plugin version immediately.
The finding
WP Maps's Pro Privileged Exploit was discovered and disclosed by Security Researcher David Brown to the developers at WP Maps Pro. As of May 20, 2016, WP Maps's Pro Privileged Exploit has been disclosed and is in use by attackers.
Why Nonce Failed
WP Maps's Pro Privileged Exploit highlights a common misconception about nonces in WordPress.
Do not confuse nonces which do not fall into the “private” category as anything related to Tokens – nonces simply track and confirm the creation of resources for specific uses and development functionality within a web service or website and do not prevent unauthorized access to these resources.
Because nonces are typically coded into HTML or JavaScript, a malicious user can quickly locate them anywhere on a web page and exploit them.
Both the WP Maps Pro Privilege Escalation attack relied on the nonce for access-control purposes and represented a very large lapse in security.
Potential Damage Caused by a Successful Attack
Successfully exploiting a privilege escalation on the WP Maps Pro would provide the malicious user with the ability to upgrade from limited user access to full system administrator privileges for all websites running on the WordPress platform, as well as any unauthorized use of non-productively by the malicious actor.
In addition, the successful exploitation of a WP Maps Pro privilege escalation provides the malicious user with the ability to host malicious code on their compromised website, launch phishing attacks from their compromised website and use the compromised website as a means to hack additional websites.
As a consequence of a successful exploit of the WP Maps Pro privilege escalation, the entire website would be taken completely over and controlled by the malicious user.
How to Protect Your Site
The WP Maps Pro privilege escalation exploit is under active attack, here is what you need to do:
1. Update the WP Maps Pro software as soon as you can. The only way to completely fix the WP Maps Pro privilege escalation vulnerability is by upgrading to version 6.1.1 or later.
2. Check for unauthorized users who may have been granted administrative rights to your site. After updating the plug-in, make sure to check your list of WordPress users and delete any that you do not recognize.
3. Review your access logs, looking for any requests that include “wpgmp_temp_access_ajax” or “wpgmp_temp_access_support,” as they could be evidence of someone trying to exploit your site’s vulnerability.
4. Check for backdoors that may have been placed on your site. Attackers will usually place one or more back doors onto your site before they attempt to use the WP Maps Pro vulnerability to take over your site; therefore, you should run a WordPress security scanner over your site to identify any malicious code present.
5. Rotate all credentials if your site has been hacked; change all WordPress user passwords, database passwords, and any stored API keys associated with your site.
The Envato Market Factor
WP Maps Pro has had over 15,000 sales on the Envato Market, and many of those customers may not be aware of the WP Maps Pro privilege escalation exploit.
Envato Market does not automatically update plugins, and site owners must manually update or rely on their own update mechanisms.
The WP Maps Pro privilege escalation exploit affects thousands of sites, and many may remain vulnerable.
Final Thoughts
The WP Maps Pro privilege escalation exploit is a critical vulnerability with a simple fix, update the plugin.
The vulnerability allows unauthenticated attackers to create administrator accounts, and attackers are actively exploiting it right now.
The WP Maps Pro privilege escalation exploit could have been prevented if the developer had not used a nonce as an access control mechanism, and if they had properly authenticated the temporary access feature.
If you use WP Maps Pro, stop reading and update your plugin now, check your admin users, and rotate your credentials, because 2,858 attacks have already been blocked, and the next one could be targeting your site.
FAQ Section
What is CVE-2026-8732?
CVE-2026-8732 is a WP Maps Pro privilege escalation exploit with a CVSS score of 9.8, it allows unauthenticated attackers to create administrator accounts via the temporary access feature.
How many attacks have been detected against this vulnerability?
Wordfence has blocked 2,858 attacks targeting the WP Maps Pro privilege escalation exploit over the past 24 hours, and active exploitation is ongoing.
What versions of WP Maps Pro are affected?
The WP Maps Pro privilege escalation exploit affects all versions of the plugin prior to and including 6.1.0, and version 6.1.1 contains the patch.
Why did the nonce protection fail?
The nonce was publicly embedded into every frontend page via wp_localize_script, and an attacker could extract it from the page, nonces are not secrets and should not be used as access control mechanisms.
What are some ways I can assess whether my website has been infiltrated?
You can verify to see if you have unwanted administrator accounts present in your WordPress user list; check for access logs showing whether you have wpgmp_temp_access_ajax or wpgmp_temp_access_support; and you can have your site scanned for any snuck in backdoors (unauthorized access).
