The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account…

CVE-2026-8732 is an unauthenticated administrator-account creation flaw in the premium WordPress plugin WP Maps Pro (wp-google-map-gold). Affected versions are all releases up to and including 6.1.0; the fix landed in 6.1.1 on 2026-05-20. The vulnerable wpgmp_temp_access_ajax path exposes a support-oriented temporary access feature through admin-ajax.php, relies on a frontend-exposed nonce instead of real authorization, then creates a new WordPress user with the administrator role and returns a passwordless magic-login URL.

The vendor's 9.8 CRITICAL rating matches reality. This is not a theoretical post-auth edge case; it is unauthenticated remote, typically reachable anywhere the WordPress site is reachable, and it ends in full application takeover with almost no attacker friction. The only real downward pressure is population size: this is a premium plugin with roughly 15.8K sales, not a core WordPress bug or a 1M-install plugin. Active exploitation wipes out most arguments for downgrading.

Why this verdict

• No attacker foothold required: baseline vendor 9.8 holds because this is unauthenticated remote against a public WordPress endpoint.
• Exploit chain is short and cheap: the nonce is exposed on the frontend, the vulnerable action is reachable through admin-ajax.php, and the attacker gets an admin user plus magic login URL with commodity tooling.
• Active exploitation overrides soft signals: low EPSS and non-KEV status would normally argue for caution, but observed attacks are stronger evidence than either metric.
• Population narrows slightly: this is a commercial plugin with about 15.8K sales, so I shaved the score a tenth below the vendor baseline rather than inflating it.

Why not higher?

There is no broader platform escape here: the blast radius is the individual WordPress site or tenant running this plugin, not every WordPress deployment everywhere. The premium-plugin footprint is meaningfully smaller than a core or mega-install plugin flaw, so a perfect 10.0 would overstate ecosystem-wide exposure.

Why not lower?

A downgrade would require real friction like authentication, internal-only reachability, role requirements, or hard environmental prerequisites. This bug has none of those in the common case, and attackers are already exploiting it in the wild.

1. Block exploit traffic now — Deploy a WAF or WordPress-layer rule that inspects POSTs to /wp-admin/admin-ajax.php for the WP Maps Pro temporary-access action and blocks them immediately, within hours because active exploitation overrides the normal CRITICAL mitigation clock.
2. Hunt for rogue administrators — Review WordPress users for unexpected admin accounts, especially fc_user_* patterns or anything tied to [email protected], and correlate with admin logins and plugin installs immediately, within hours. This matters because patching alone does not remove already-created attacker accounts.
3. Constrain stage-two persistence — Disable in-dashboard plugin/theme editing where feasible, lock file permissions on wp-content, and alert on new PHP files or plugin installs immediately, within hours to blunt the post-compromise blast radius if an attacker already landed.
4. Prefer protected WordPress edge controls — If you already run Wordfence Premium/Care/Response or equivalent virtual patching, verify the protection is active immediately, within hours; this is a useful bridge while patching, not a replacement for it.

Run this on the target WordPress host as a user that can read the web root; root is only needed if file permissions are tight. Invoke it with the WordPress path, for example: bash ./check_wp_maps_pro.sh /var/www/html. It inspects the plugin directory, extracts the installed version if possible, and checks for the authorization fix.

#!/usr/bin/env bash
# check_wp_maps_pro.sh
# Detects whether WP Maps Pro (wp-google-map-gold) is vulnerable to CVE-2026-8732.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

if [ "$#" -ne 1 ]; then
  echo "Usage: $0 /path/to/wordpress"
  echo "UNKNOWN"
  exit 2
fi

WP_ROOT="$1"
PLUGIN_DIR="$WP_ROOT/wp-content/plugins/wp-google-map-gold"

if [ ! -d "$PLUGIN_DIR" ]; then
  echo "UNKNOWN - plugin directory not found: $PLUGIN_DIR"
  echo "UNKNOWN"
  exit 2
fi

find_main_php() {
  local dir="$1"
  local f
  while IFS= read -r -d '' f; do
    if grep -Eiq '^[[:space:]]*Plugin Name:[[:space:]]*WP Maps Pro' "$f" 2>/dev/null; then
      echo "$f"
      return 0
    fi
  done < <(find "$dir" -maxdepth 2 -type f -name '*.php' -print0 2>/dev/null)

  # Fallbacks for common filenames
  for f in "$dir/wp-google-map-gold.php" "$dir/wp-google-map-pro.php" "$dir/index.php"; do
    if [ -f "$f" ]; then
      echo "$f"
      return 0
    fi
  done

  # Last resort: first PHP file
  find "$dir" -maxdepth 2 -type f -name '*.php' 2>/dev/null | head -n 1
}

version_lte() {
  # returns 0 if $1 <= $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ]
}

MAIN_PHP="$(find_main_php "$PLUGIN_DIR")"
VERSION=""
if [ -n "$MAIN_PHP" ] && [ -f "$MAIN_PHP" ]; then
  VERSION="$(grep -Eim1 '^[[:space:]]*Version:[[:space:]]*' "$MAIN_PHP" | sed -E 's/^[[:space:]]*Version:[[:space:]]*//I' | tr -d '\r')"
fi

# Look for the patch condition added by vendor.
HAS_FIX=0
if grep -RqsE "current_user_can\s*\(\s*['\"]manage_options['\"]\s*\)" "$PLUGIN_DIR"; then
  HAS_FIX=1
fi

if [ -n "$VERSION" ]; then
  echo "Detected version: $VERSION"
else
  echo "Detected version: unknown"
fi

echo "Authorization fix present: $HAS_FIX"

if [ "$HAS_FIX" -eq 1 ]; then
  echo "PATCHED"
  exit 0
fi

if [ -n "$VERSION" ]; then
  if version_lte "$VERSION" "6.1.0"; then
    echo "VULNERABLE"
    exit 1
  else
    echo "PATCHED"
    exit 0
  fi
fi

echo "UNKNOWN - could not determine version and fix string not found"
echo "UNKNOWN"
exit 2

Sources

1. NVD CVE record
2. Wordfence blog analysis and disclosure timeline
3. Wordfence threat intel record
4. Vendor marketplace page / changelog
5. BleepingComputer exploitation report
6. CISA KEV catalog
7. FIRST EPSS data and stats