CVE-2026-8732: WP Maps Pro <= 6.1.0 - Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX Action

Synopsis

Unauthenticated privilege escalation in the WP Maps Pro WordPress plugin (versions up to and including 6.1.0). The flaw reaches the wpgmp_temp_access_ajax AJAX action over the network without authentication; the nonce gating the handler is published on every frontend page via wp_localize_script, so it provides no real access control. Successful exploitation creates a new administrator account through wp_insert_user() and returns a magic login URL that issues a full auth cookie, resulting in complete site takeover. No upstream fix is published yet; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker only needs to reach the WordPress site's admin-ajax.php endpoint over the network, which is typically internet-facing.

• AuthenticationNot required

  The AJAX action is registered with wp_ajax_nopriv_, so no WordPress account or session is needed.

• Victim interactionNot required

  The attacker drives the entire flow by calling the AJAX endpoint and visiting the returned magic login URL directly.

• Attack complexityDetail

  The exploit is reliable and condition-free: the nonce is published in page source and the handler unconditionally creates an administrator.

Blast Radius

• Creates a new WordPress user with the administrator role via wp_insert_user(), giving the attacker a persistent privileged account.
• Returns a magic login URL that calls wp_set_auth_cookie(), letting the attacker authenticate as that administrator without a password.
• Enables full read of site content, user data, and stored secrets, plus modification of posts, plugins, themes, and options.
• Allows arbitrary plugin or theme upload, which is a standard path to remote code execution on the WordPress host.