Reported by 1 outlet

CVE-2026-8732 — WP Maps Pro Bug Exploited to Create Admin Accounts on 15,800+ WordPress Sites

hot0.0

Why this score

Breadth: 0.50 / 2.0 · 1 source
Authority: 1.80 / 2.0 · best outlet weight
Severity: 4.50 / 5.0 · CVSS + content signals
Velocity: 0.00 / 2.0 · updates in 48h
Pickup speed: 0.00 / 0.6 · time to second source
Recency: × 0.00 temporal multiplier
Community: + 0.00 / 1.5 · reddit signal
Score: 0.0 / 10 = base × recency + community

bleepingcomputer.com CVE-2026-8732 first seen 135d ago

Timeline

original reporting

CVE-2026-8732 — WP Maps Pro Bug Exploited to Create Admin Accounts on 15,800+ WordPress Sites

bleepingcomputer.com · 135d ago · June 1st, 2026

Hackers are actively targeting WordPress websites running WP Maps Pro — a premium interactive map plugin with 15,800+ sales on Envato Market — exploiting a critical unauthenticated privilege escalation vulnerability tracked as CVE-2026-8732. The flaw lies in a "temporary access" AJAX endpoint intended for vendor support access, protected only by a publicly exposed nonce in frontend JavaScript.

Attackers send a crafted request with check_temp set to false, triggering wp_insert_user() to create a new WordPress administrator account with a randomized username, hardcoded email (support@flippercode.com), and a passwordless "magic login URL" returned in the response body. Wordfence researchers blocked 3,600+ exploitation attempts in 24 hours.

Impact: Full site takeover — persistent backdoors, web shells, malicious plugin installation, private data access. All versions before 6.1.1 are vulnerable. The patch was released May 20 (vendor notified May 16 after proof of concept). Administrators should update immediately and audit for rogue admin accounts.

Covered in

digest 2026-06-01

Source on GitHub