CVE-2026-8935
Critical
Description
The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuing its map script, unconditionally creates an administrator account and returns a magic-login URL granting interactive admin access.
SeverityCritical
CVSS9.8
Exploit probability—
ProductWP MAPS PRO
PublishedJun 15, 2026
First seenJun 15, 2026
Weakness typeCWE-269Improper privilege management
How to fix
Update
- WP MAPS PRO6.1.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WP MAPS PRO | v < 6.1.1 | 6.1.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.