Warning: Critical flaw in WP Maps Pro plugin actively exploited to take over WordPress sites

Hung Pham
Jun 3
3 min read

If your WordPress website uses the premium plugin WP Maps Pro to display store locations or integrate advanced maps, you need to check your system immediately.

Cybersecurity experts have recently discovered a highly dangerous security vulnerability that is being actively exploited in the wild, allowing attackers to secretly seize full administrative control of affected websites.

How dangerous is the CVE-2026-8732 security flaw?

WP Maps Pro is a popular extension on the WordPress platform, helping website owners embed customized Google Maps or OpenStreetMap with advanced location and routing features. With over 15,000 sales on the Envato Market (CodeCanyon), the number of sites globally at risk from this vulnerability is substantial.

Tracked internationally as CVE-2026-8732, this flaw has been assigned a near-maximum severity score of 9.8/10 on the CVSS scale. According to reports published by SecurityWeek and The Hacker News, this bug falls into the "unauthenticated privilege escalation" category. This means a complete outsider, without any legitimate account on the system, can silently create an account with the highest privileges - an Administrator account - to gain total control over the victimized website.

How do attackers seize administrative control?

Security researcher David Brown - who first discovered the flaw - explained that the vulnerability stems from a feature called "temporary access." This feature was originally designed to allow the plugin developer's technical support staff to log into customers' websites to troubleshoot issues when needed.

However, due to a programming oversight, the function handling this request (wpgmp_temp_access_support) can be invoked remotely without proper identity verification. Although the system uses a security token (known as a nonce) to validate the request, this token is exposed publicly on all frontend pages of the website. Consequently, anyone can easily obtain this token, rendering the plugin's security barrier useless.

By exploiting this loophole, an attacker only needs to send a specially crafted request to bypass the temporary time check (check_temp=false). The system then automatically generates a new WordPress user with a permanent Administrator role and returns a special login link, allowing malicious actors to step right into the website's ultimate management panel without any obstacles.

Alarmingly high level of active exploitation

According to security analysis documented on the specialized platform Threat Modeling, a wave of attacks targeting websites with this plugin installed has officially surged on a broad scale.

Cybersecurity monitoring systems have recorded up to 2,858 exploitation attempts targeting this vulnerability within just a 24-hour window. This indicates that hacker groups are aggressively racing against time, deploying automated scanning tools to hunt down and compromise websites that have not yet implemented defensive measures.

Immediate remediation steps for administrators

This dangerous flaw threatens all versions of the WP Maps Pro plugin from version 6.1.0 and below. To protect your website's assets and data, system administrators must urgently take the following steps:

Update the software immediately: Upgrade the WP Maps Pro plugin to version 6.1.1 as soon as possible. The developer has released this patch to eliminate or tighten security for the flawed temporary access feature.
Deactivate if unable to update: If you cannot upgrade to the new version immediately, temporarily deactivate or completely remove the plugin from your website to block the risk of exploitation.
Audit the user list: Access the user management section on your WordPress dashboard to carefully check for the appearance of any unfamiliar Administrator accounts created recently. If any suspicious activity is detected, delete that account immediately and conduct a thorough, deep security audit.

The security incident involving the WP Maps Pro plugin serves as a powerful reminder to website owners about the critical importance of routine software updates. In the digital world, delaying an update by even a single day can leave an entire business system vulnerable to being paralyzed or falling into the wrong hands. Be proactive, audit your system, and apply security measures today to keep your website safe.