PT-2026-44744 · WordPress · Wp Maps Pro
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
WP Maps Pro versions prior to 6.1.1
Description
An unauthenticated privilege escalation flaw exists in the WP Maps Pro plugin, which is used by over 15,000 websites. The issue stems from a temporary access feature designed for support troubleshooting. The AJAX action
wpgmp temp access ajax is registered for unauthenticated users and relies on a nonce check using fc-call-nonce. However, this nonce is publicly embedded in the frontend JavaScript object wpgmp local, making the check ineffective. An attacker can invoke the wpgmp temp access support() handler with the parameter check temp=false to unconditionally create a new WordPress user with administrator privileges via wp insert user(). The system then returns a magic login URL that uses wp set auth cookie() to authenticate the attacker as the new administrator, leading to complete site takeover. This flaw has been actively exploited in the wild, with thousands of attacks blocked by security services in single-day periods.Recommendations
Update WP Maps Pro to version 6.1.1 or later.
As a temporary workaround, disable the plugin until the update is applied.
Audit the administrator user list and remove any unrecognized accounts.
Review site logs for POST requests to
wp-admin/admin-ajax.php with the action wpgmp temp access support to identify potential exploitation.Fix
LPE
Missing Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Wp Maps Pro