CVE-2026-8935 — Advanced Google Maps < 6.1.1 - Unauthenticated Administrator Account Creation

CVE-2026-8935

Advanced Google Maps < 6.1.1 - Unauthenticated Administrator Account Creation PUBLISHED

Description (CNA)

The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuing its map script, unconditionally creates an administrator account and returns a magic-login URL granting interactive admin access.

Affected (CNA)

Vendor / product	Versions
Unknown / WP MAPS PRO	affected 0 before 6.1.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/9bad9fc1-5032-45dc-983f-ba2dd7092385/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.