CVE-2026-8935: Unknown Wp Maps Pro

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuing its map script, unconditionally creates an administrator account and returns a magic-login URL granting interactive admin access.

Affected products

• Unknown Wp Maps Pro: before 6.1.1 (fixed in 6.1.1)

Published 2026-06-15. Last modified 2026-07-23.