WordPress WP Maps Pro Unauthenticated Admin Account Creation

The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ and protected only by a nonce check using the fc-call-nonce nonce, which is publicly embedded into every frontend page via wp_localize_script as the nonce field of the wpgmp_local JavaScript object, rendering the check ineffective as an access control mechanism. This makes it possible for unauthenticated attackers to invoke the wpgmp_temp_access_support handler with check_temp=false, which unconditionally creates a new WordPress user with the hardcoded role of administrator via wp_insert_user() and returns a magic login URL that, when visited, calls wp_set_auth_cookie() to fully authenticate the attacker as the newly created administrator, resulting in complete site takeover.

Casky was already ahead

This CVE exploits attack patterns that Casky's 261matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The WP Maps Pro plugin for WordPress contains a critical privilege escalation vulnerability that allows unauthenticated attackers to create administrator accounts. The vulnerability exists in the wpgmp_temp_access_ajax AJAX action, which is registered with wp_ajax_nopriv_ (making it accessible to unauthenticated users) and relies solely on a nonce check for protection. However, the nonce value is publicly embedded in every frontend page via wp_localize_script, rendering it useless as a security control since attackers can simply extract it from the HTML source. This affects all versions of WP Maps Pro up to 6.1.0 and represents a complete authentication bypass leading to administrative privilege escalation. Any website running this plugin is immediately vulnerable to account takeover and full site compromise.

Casky's 261 matching skills—powered by Claude AI with extended reasoning—detect this vulnerability pattern by analyzing both Initial Access (TA0004) and Credential Access (TA0006) attack chains. Practitioners using Casky would identify findings revealing: (1) insecure AJAX action registration patterns where wp_ajax_nopriv_ hooks lack proper authentication, (2) ineffective nonce implementations where token values are publicly exposed in client-side JavaScript objects, and (3) direct indicators of account creation endpoints accessible without authentication. The extended reasoning capabilities would correlate these technical findings with real-world exploitation mechanics, showing how an attacker moves from reconnaissance (extracting the public nonce) to account creation to privilege escalation, helping practitioners understand not just that the vulnerability exists, but how it enables the complete attack chain toward administrative control.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

261 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-8732.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-kubernetes-audit-logs

container security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-8732

Casky has 261 skills that investigate the attack patterns behind CVE-2026-8732. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn