WP Maps Professional trojan horse exploited to create admin accounts on WordPress websites

Hackers are focused on WordPress internet sites working a prone model of the WP Maps Professional plugin, which permits developing rogue administrator accounts with out authentication.

The vulnerability, tracked as CVE-2026-8732, has a vital severity score and affects WP Maps Professional variations 6.1.0 and older. It was once found out and reported through safety researcher David Brown.

WP Maps Professional is a top rate WordPress plugin for development interactive, customizable maps and retailer locators. It helps a couple of map suppliers, reminiscent of Google Maps and OpenStreetMap.

The plugin is normally utilized by companies, actual property internet sites, shuttle websites, directories, and organizations that wish to show a couple of places on a map, and has over 15,800 gross sales at the Envato Marketplace.

The CVE-2026-8732 vulnerability is brought about through a “brief get admission to” function within the plugin, meant to permit seller strengthen group of workers to get admission to buyer websites for troubleshooting.

Brown discovered that the AJAX endpoint used for this option was once out there to unauthenticated customers and relied only on a publicly uncovered nonce test in frontend JavaScript, rendering the safety useless.

This permits sending a specifically crafted request that triggers code to create a brand new WordPress person, assign it the administrator position, generate a passwordless login URL, and ship it to a far off machine.

As soon as the attacker visits this URL, they’re mechanically authenticated to the newly created administrator account, and not using a password or another verification required.

Researchers at WordPress safety corporate Defiant seen that risk actors are looking to exploit the vulnerability, and blocked greater than 3,600 makes an attempt during the last 24 hours.

“When the request is made with a check_temp parameter set to false, the serve as creates a brand new WordPress person by means of wp_insert_user() with the hardcoded position of administrator, a randomly generated username, and the hardcoded e-mail deal with strengthen@flippercode.com,” the researchers give an explanation for.

“The serve as then generates a “magic login URL” the use of generate_login_link(), shops it as person meta, and returns it within the reaction frame.”

Having admin-level get admission to at the web site manner attackers can inject power backdoors, regulate content material, get admission to non-public knowledge, deploy internet shells, set up malicious plugins, and take over the site.

Brown reported the flaw to Wordfence on March 24, and the seller was once notified on Might 16 after validating the exploit.

On Might 20, WP Maps Professional 6.1.1 was once launched with a repair for CVE-2026-8732. Website online directors are advisable to replace their plugins once conceivable, as malicious job has already been seen.