CVE-2026-8732

Published May 29, 2026

Last updated a month ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-8732 is a privilege escalation vulnerability found in the WP Maps Pro plugin for WordPress, affecting all versions up to and including 6.1.0. The flaw stems from the `wpgmp_temp_access_ajax` AJAX action, which was registered to be accessible by unauthenticated users (`wp_ajax_nopriv_`). Although a nonce check was in place, the required nonce (`fc-call-nonce`) was publicly embedded into every frontend page of the website via `wp_localize_script`, making it easily retrievable by an attacker. This design oversight allows unauthenticated attackers to extract the publicly available nonce and then invoke the `wpgmp_temp_access_support` handler with a specific parameter (`check_temp=false`). This action unconditionally creates a new WordPress user with administrator privileges and provides a "magic login URL." By visiting this URL, the attacker is fully authenticated as the newly created administrator, enabling a complete takeover of the affected WordPress site. The vulnerability was discovered by security researcher David Brown and has been addressed in version 6.1.1 of the plugin.

Description: The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ and protected only by a nonce check using the fc-call-nonce nonce, which is publicly embedded into every frontend page via wp_localize_script as the nonce field of the wpgmp_local JavaScript object, rendering the check ineffective as an access control mechanism. This makes it possible for unauthenticated attackers to invoke the wpgmp_temp_access_support handler with check_temp=false, which unconditionally creates a new WordPress user with the hardcoded role of administrator via wp_insert_user() and returns a magic login URL that, when visited, calls wp_set_auth_cookie() to fully authenticate the attacker as the newly created administrator, resulting in complete site takeover.
Source: security@wordfence.com
NVD status: Deferred

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security@wordfence.com: CWE-306

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 2

References