Critical WP Maps Pro Flaw Actively Exploited to Create Admin Accounts

Summary: Attackers are actively exploiting CVE-2026-8732, a privilege escalation flaw with a CVSS score of 9.8 in the WP Maps Pro WordPress plugin, which has over 15,000 sales on Envato Market and is used as a store locator tool. The bug, affecting all versions up to and including 6.1.0 and fixed in 6.1.1 on May 20, 2026, lets unauthenticated attackers call the wpgmp_temp_access_support() function with check_temp=false to create an administrator user and receive a magic login URL that authenticates them as that admin.
Key Takeaway: Wordfence says it blocked 2,858 attacks targeting this flaw in the past 24 hours, and the nonce meant to guard the endpoint is embedded in every frontend page, so it offers no real access control.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-8732
Related: ⚡ Weekly Recap: New Linux Flaw, PAN-OS Exploit, AI-Powered Attacks, OAuth Phishing and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026