Actively Exploited WordPress Plugin Flaw (CVE-2026-8732) Allows Unauthenticated Admin Account Creation

Executive Summary

A critical authentication bypass vulnerability, CVE-2026-8732, has been found in the WP Maps Pro plugin for WordPress. The flaw is rated 9.8 out of 10 and is being actively exploited to create rogue administrator accounts on vulnerable websites. The issue stems from an insecurely implemented 'temporary access' feature that allows any unauthenticated user to trigger an AJAX action and create an admin account. The plugin developer has released version 6.1.1 to fix the issue, but with over 15,000 active installations, many sites remain at risk. Security firm Wordfence reported blocking thousands of attacks, indicating automated and widespread exploitation.

Vulnerability Details

The vulnerability resides in all versions of the WP Maps Pro plugin up to and including 6.1.0. The plugin includes a feature for support staff to gain temporary access to a customer's WordPress dashboard. This was implemented via an AJAX action hook, wpgmp_temp_access_ajax.

Critically, this function had no capability checks or authentication requirements. Any user, including an unauthenticated visitor, could send a direct POST request to the WordPress admin-ajax.php endpoint with the action set to wpgmp_temp_access_ajax. This would trigger the function, which would then create a new user account with a specified username and password and assign it the 'administrator' role. This provides the attacker with full control over the compromised website.

Affected Systems

• Product: WP Maps Pro plugin for WordPress
• Vulnerable Versions: All versions up to and including 6.1.0
• Patched Version: 6.1.1 and later
• Install Base: Over 15,000 active installations are potentially vulnerable.

Exploitation Status

This vulnerability is under active and widespread exploitation. The ease of the exploit (a single HTTP request) makes it trivial to automate. Security firm Wordfence confirmed it blocked 2,858 exploitation attempts within a single 24-hour period shortly after the flaw was disclosed. Attackers are scanning the internet for sites with the vulnerable plugin and attempting to create admin accounts, typically with common usernames like admine or wp-admin.

Impact Assessment

The impact of exploitation is a complete site takeover. An attacker with an administrator account can:

• Deface the website.
• Inject malicious code, backdoors, or credit card skimmers.
• Redirect traffic to malicious sites.
• Use the site to host phishing pages or malware.
• Delete the entire site's content and backups.
• Gain access to sensitive user data stored by the website.

For any business relying on their WordPress site, this is a critical incident that can lead to significant financial and reputational damage.

Cyber Observables — Hunting Hints

Web administrators should hunt for signs of compromise.

Detection & Response

1. Review Admin Accounts: The first step is to immediately log into your WordPress dashboard and navigate to the 'Users' section. Look for any administrator accounts you do not recognize. If found, delete them immediately.
2. Log Analysis: Analyze web server access logs for POST requests to /wp-admin/admin-ajax.php that include action=wpgmp_temp_access_ajax. Any hits from untrusted IPs are strong indicators of an attack. This is a form of D3FEND Web Session Activity Analysis.
3. Web Application Firewall (WAF): Deploy a WAF with rules specifically designed to block exploitation attempts against CVE-2026-8732. Many commercial WAF providers have already pushed these rules.

Mitigation

1. Update Immediately (M1051): The most critical action is to update the WP Maps Pro plugin to version 6.1.1 or later. This version removes the vulnerable code. This is a direct application of D3FEND's Software Update.
2. Remove if Unused: If the plugin is not essential to your site's functionality, the safest course of action is to deactivate and delete it entirely.
3. Harden WordPress: Enforce the principle of least privilege for all user accounts. Regularly audit admin accounts and enable Multi-factor Authentication (M1032) for all administrator-level users to make account takeover more difficult.