PT-2026-49185 · WordPress · Wp Maps Pro

Erwan Lr · CVE-2026-8935 · Published 2026-06-15 · Updated 2026-06-16

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP MAPS PRO versions prior to 6.1.1

Description The plugin registers an unauthenticated AJAX action that allows the creation of an administrator account. By providing a valid nonce, which is publicly available on any frontend page that enqueues the map script, an attacker can unconditionally create an admin account and receive a magic-login URL that provides interactive administrative access.

Recommendations Update to version 6.1.1 or later.

Exploit

Fix

Related Identifiers

CVE-2026-8935

Affected Products

Wp Maps Pro

References · 8

• 🔥 https://wpscan.com/vulnerability/9bad9fc1-5032-45dc-983f-ba2dd7092385 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8935 · Security Note
• https://twitter.com/CVEnew/status/2066583828408250596 · Twitter Post
• https://t.me/CVEtracker/56846 · Telegram Post
• https://twitter.com/infoflowcloud/status/2066584366516433257 · Twitter Post
• https://twitter.com/ADKCyber/status/2066678062943465855 · Twitter Post
• https://twitter.com/threatcluster/status/2066951768009773342 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2066449400864350231 · Twitter Post