CVE-2026-8935
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The WP MAPS PRO WordPress plugin before version 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuing its map script, unconditionally creates an administrator account and returns a magic-login URL granting interactive admin access.
Risk Assessment
Any unauthenticated user can gain full administrative access to WordPress, leading to complete site takeover.
Recommendation
Immediately update the WP MAPS PRO plugin to version 6.1.1 or later.
Original NVD description (English source)
The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuing its map script, unconditionally creates an administrator account and returns a magic-login URL granting interactive admin access.