Vulnerability

CERT-In Vulnerability Note CIVN-2026-0299
Privilege Escalation Vulnerability in WP Maps Pro plugin for WordPress

Original Issue Date:June 10, 2026

Severity Rating: CRITICAL

Software Affected

WP Maps Pro plugin for WordPress versions prior to 6.1.1.

Overview

A vulnerability has been reported in WP Maps Pro plugin for WordPress, which could allow a remote attacker to gain elevated privileges on the targeted system.

Target Audience:
All end-user organizations and individuals using WP Maps Pro plugin for WordPress.

Risk Assessment:
High risk of Privilege escalation.

Impact Assessment:
Potential for full site compromise via unauthorized administrator access and Authentication bypass.

Description

WP Maps Pro is a WordPress plugin used for creating interactive maps and location-based services.

The vulnerability exists in WP Maps Pro plugin is due to improper access control in the wpgmp_temp_access_ajax AJAX action, which is exposed to unauthenticated users via wp_ajax_nopriv_ and relies only on a publicly accessible nonce (fc-call-nonce). This weak protection allows attackers to bypass authentication and invoke the wpgmp_temp_access_support function, leading to unauthorized administrator account creation and full site compromise.

Successful exploitation of this vulnerability could allow the attacker to gain elevated privileges on the targeted system.

Solution

Apply appropriate fix/patches as mentioned:
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-google-map-gold/wp-maps-pro-610-unauthenticated-privilege-escalation-via-administrator-account-creation-to-wpgmp-temp-access-ajax-ajax-action

Vendor Information

WordPress
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-google-map-gold/wp-maps-pro-610-unauthenticated-privilege-escalation-via-administrator-account-creation-to-wpgmp-temp-access-ajax-ajax-action

References

CVE Name
CVE-2026-8732

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India