A critical vulnerability in the WP Maps Pro WordPress plugin has been exploited, allowing unauthorized creation of administrator accounts on affected websites and raising serious concerns about site integrity and data security. Security researchers discovered a flaw that permits attackers to bypass authentication controls and gain full administrative privileges without valid credentials.
WP Maps Pro is a widely used plugin that businesses and organizations deploy to embed interactive maps within WordPress sites, enhancing website functionality. The vulnerability stems from the plugin’s handling of user input and access control mechanisms, enabling attackers to escalate privileges and undermine the security model of WordPress installations running this plugin.
The flaw became publicly known after multiple reports indicated unauthorized creation of admin accounts linked to WP Maps Pro installations. Attackers can manipulate the plugin’s processes to insert new administrator-level users, bypassing standard authentication and authorization protocols.
Once attackers gain access, they can deploy malicious code, alter site content, or pivot to other parts of the hosting environment, increasing the risk of broader compromise. As of now, WP Maps Pro developers have not released a patch addressing this issue; administrators are advised to disable the plugin or restrict its usage until a fix is available and to implement compensating controls where possible.
“This vulnerability represents a significant risk for WordPress sites using WP Maps Pro,” said a cybersecurity analyst familiar with the exploit. “Unauthorized admin access can lead to complete site takeover, data exfiltration, and persistent malicious activity. Administrators must prioritize mitigation steps and monitor logs for suspicious account creations.”
The WP Maps Pro case highlights the challenges of plugin security within the WordPress ecosystem, where third-party components can introduce severe vulnerabilities. Security teams should carefully scrutinize installed plugins for known flaws and apply strict access controls to reduce exposure and potential impact.
Failing to address such vulnerabilities promptly can result in compromised customer data, reputational damage, and regulatory scrutiny, especially for organizations subject to data protection laws. CISOs and security buyers should factor vendor responsiveness and patch management practices into component selection to minimize operational risk.
Source: bleepingcomputer.com
