Vulnerability · Published Jun 15, 2026 · Assigned by WPScan
CVE-2026-8935Advanced Google Maps < 6.1.1 - Unauthenticated Administrator Account Creation
Critical 9.8
In plain English
A critical-severity security flaw in WP MAPS PRO from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.3%top 80.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuing its map script, unconditionally creates an administrator account and returns a magic-login URL granting interactive admin access.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WP MAPS PRO | 0 – before 6.1.1 |
References
- https://wpscan.com/vulnerability/9bad9fc1-5032-45dc-983f-ba2dd7092385/ exploit, vdb-entry, technical-description