WP Maps Pro bug exploited to create admin accounts on WordPress sites
Recorded: May 31, 2026, 3 p.m.
| Original | Summarized |
WP Maps Pro bug exploited to create admin accounts on WordPress sites News Featured California AG sues 23andMe over 2023 breach exposing health data US charges Google security engineer with Polymarket insider trading Charter Communications data breach affects 4.9 million accounts GreyVibe hackers use ChatGPT, Gemini to power cyberattacks WP Maps Pro bug exploited to create admin accounts on WordPress sites Get a lifetime of ethical hacking and Python security training for $15 Palo Alto GlobalProtect VPN auth bypass flaw now exploited in attacks New CIFSwitch Linux flaw gives root on multiple distributions Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityWP Maps Pro bug exploited to create admin accounts on WordPress sites WP Maps Pro bug exploited to create admin accounts on WordPress sites By Bill Toulas May 31, 2026 Hackers are targeting WordPress websites running a vulnerable version of the WP Maps Pro plugin, which allows creating rogue administrator accounts without authentication. Creating a rogue admin userSource: Wordfence The Validation Gap: Automated Pentesting Answers One Question. You Need Six. Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not built to test whether your controls block threats, your detection rules fire, or your cloud configs hold.This guide covers the 6 surfaces you actually need to validate. Related Articles: Actively Exploited Bill Toulas Previous Article Post a Comment Community Rules You need to login in order to post a comment Not a member yet? Register Now You may also like: Upcoming Webinar Popular Stories ChatGPT share links abused to host fake outage pages to deliver malware Anthropic confirms Claude Mythos-class models will roll out to the public Carnival Cruise confirms data breach affecting nearly 6 million people Sponsor Posts AI is a data-breach time bomb: Read the new report #1 MSP Benchmark report 2026: Insights from 1,000+ MSPs on growth, security, artificial intelligence, and key 2026 trends. Overdue a password health-check? Audit your Active Directory for free 33% Rise in Healthcare Credential Theft in 2025: What you need to know Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
Hackers are actively exploiting a vulnerability in the WP Maps Pro plugin that allows for the creation of unauthorized administrator accounts on WordPress websites. This vulnerability, tracked as CVE-2026-8732, poses a critical severity risk and affects versions 6.1.0 and earlier of the plugin. WP Maps Pro is a premium WordPress plugin designed for creating interactive and customizable maps and store locators, commonly utilized by entities such as businesses, real estate sites, and organizations. The flaw stems from a feature within the plugin called "temporary access," which was intended to facilitate troubleshooting by vendor support staff. Security researcher David Brown discovered the vulnerability when he found that the AJAX endpoint associated with this feature was accessible to unauthenticated users. This access was permitted despite relying solely on a nonce check in the frontend JavaScript, which proved ineffective against malicious requests. This deficiency allowed threat actors to send specially crafted requests that triggered functions capable of creating a new WordPress user, assigning it the administrator role, generating a passwordless login URL, and transmitting this link to a remote system. Upon visiting this URL, the attacker was automatically authenticated as the newly created administrator without needing any password or further verification. Specifically, the researchers explained that when a request with the check_temp parameter set to false was made, the underlying function utilized wp_insert_user() to create a new WordPress user, assigning the hardcoded role of administrator, a randomly generated username, and the hardcoded email address support@flippercode.com. Furthermore, the function generated a "magic login URL" using generate_login_link() and stored it in user metadata before returning it in the response body. Gaining administrator-level access grants attackers significant control over the compromised websites, enabling a wide range of malicious activities. These include injecting persistent backdoors, modifying website content, accessing private data, deploying web shells, installing malicious plugins, and ultimately taking complete control of the site. Following the discovery, Brown reported the flaw to Wordfence on March 24th, and the vendor was notified on May 16th after validating the exploit. To mitigate this risk, WP Maps Pro version 6.1.1 was released on May 20th, which contains a fix for CVE-2026-8732. Website administrators are strongly advised to update their plugins immediately to address this known vulnerability, as malicious activity has already been documented. |