Privilege escalation affecting WP MAPS PRO
A vulnerability affecting WP MAPS PRO would allow an unauthenticated attacker to gain elevated privileges on affected systems.
Description
Technical context and vulnerability details
WP MAPS PRO is a WordPress plugin dedicated to creating and displaying custom interactive maps. This extension is affected by a vulnerability labeled CVE-2026-8935 resulting from the recording of an AJAX action accessible without authentication. Exploitation of this vulnerability would allow an unauthenticated attacker to use a publicly exposed security token (nonce) to generate an unauthorized administrator account. It is classified critical with a severity score of 9.8 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Privilege escalation;
- Creation of unauthorized administrator account;
- Data privacy breach;
- Compromise of system integrity;
Affected systems
Products, components and targeted versions
- Versions prior to 6.1.1 of WP MAPS PRO;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update WP MAPS PRO to its latest stable version;
- Temporarily disable the extension if the update cannot be applied immediately;
- Audit recently created administrator accounts on affected WordPress sites;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.