CVE-2026-8935: Advanced Google Maps < 6.1.1 - Unauthenticated Administrator Account Creation

Synopsis

This is an authentication bypass and privilege escalation vulnerability in the WP MAPS PRO WordPress plugin (Advanced Google Maps) before version 6.1.1. An attacker with network access and no credentials can call an unauthenticated AJAX endpoint, supply a nonce that is publicly available on any frontend page loading the map script, and immediately receive a fully privileged administrator account plus a ready-to-use login URL. Successful exploitation gives the attacker complete administrative control over the WordPress site, including the ability to read all data, modify or delete content, and install arbitrary code. A patched-image rebuild at version 6.1.1 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable AJAX endpoint is exposed over the network, so an attacker must be able to reach the WordPress site via HTTP or HTTPS.

• AuthenticationNot required

  No account or credentials of any kind are needed; the endpoint accepts unauthenticated requests.

• Victim interactionNot required

  No victim action is required; the attacker calls the endpoint directly without any user involvement.

• Attack complexityDetail

  The exploit is reliable and condition-free: the required nonce is emitted in plaintext on any frontend page that loads the map script, making it trivially collectible before triggering the attack.

Blast Radius

• Attacker creates a net-new WordPress administrator account and receives a ready-to-use magic login URL, gaining full interactive admin access immediately.
• With admin access, the attacker reads all stored site data including private posts, user records, API keys, and any credentials stored in the WordPress database.
• The attacker can install or modify plugins and themes to execute arbitrary server-side code, escalating beyond WordPress into the underlying container or host.
• All site content, configuration, and user data can be modified or deleted, including replacement of legitimate pages with attacker-controlled content.