CVE-2026-8732

CVE-2026-8732 in WP Maps Pro is a critical unauthenticated remote code execution vector with a CVSS score of 9.8, and that score is earned. The vulnerability isn't a single mistake — it's an architectural failure where every protective layer was either fundamentally misdesigned or entirely absent. The AJAX endpoint handling the 'temporary admin' feature was registered with wp_ajax_nopriv_, explicitly permitting unauthenticated requests. The nonce meant to protect it was embedded in frontend JavaScript via wp_localize_script, making it a public constant rather than a secret. There's no security boundary here to breach — the developer built a doorway and left it wide open while believing they'd installed a lock. The feature creates a hardcoded administrator account with no expiration, no cleanup, and returns working credentials directly to the requester. Visit the generated URL and you're authenticated as admin with full site control. This is complete site takeover with zero prerequisites — no钓鱼, no credential guessing, no lateral movement required. The pattern of magic login URLs, hardcoded admin creation, exposed nonces, and unauthenticated AJAX endpoints has appeared in numerous compromised WordPress plugins over the past fifteen years. Whether this represents malicious code, incompetent development, or a support feature that escaped into production and was never audited, the result is identical: maximum damage with minimum effort. If you're running WP Maps Pro, patch immediately — and audit your other plugins for the same topology. This isn't a nonce bypass; it's a control that was architecturally incapable of providing access control from inception.

Reviewed through automated stages and approved by a human before publication.