Critical WP Maps Pro Plugin Vulnerability Allowed Unauthenticated Admin Account Creation A severe security flaw in the WP Maps Pro WordPress plugin (versions up to 6.1.0) enabled unauthenticated attackers to create administrator accounts, leading to potential full site takeovers. The vulnerability, discovered by security researcher David Brown and reported via the Wordfence Bug Bounty Program on March 24, 2026, affected over 15,000 installations at the time of disclosure. The flaw stemmed from an improperly secured AJAX action in the plugin’s temporary access feature, originally designed for support staff. The `wpgmp_temp_access_ajax_callback()` function lacked a capability check, allowing unauthenticated users to exploit it. Attackers could trigger the function by bypassing a publicly exposed nonce, then execute `wpgmp_temp_access_support()` to generate a new administrator account with: - A randomly generated username (e.g., `fc_user_*`), - The hardcoded email [email protected], - Full administrator privileges. The plugin then provided a login URL that authenticated the attacker without requiring a password, granting them unrestricted access to: - Install malicious plugins, - Modify themes, - Inject backdoors, - Deploy webshells, - Steal site data. The vendor patched the issue in WP Maps Pro 6.1.1, released on May 20, 2026, by adding a capability check to restrict the vulnerable endpoint to authenticated administrators. Wordfence provided firewall protection to Premium, Care, and Response users on May 18, 2026, with free users scheduled to receive the same protection on June 17, 2026. The vulnerability was escalated to Envato’s security team on May 16, 2026, after researchers failed to locate direct vendor contact information.