CVE-2026-8732Active Exploitation

CRITICALCVSS 9.8 · CRITICAL

Exploitation observed; activity peaked at 28 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ and protected only by a nonce check using the fc-call-nonce nonce, which is publicly embedded into every frontend page via wp_localize_script as the nonce field of the wpgmp_local JavaScript object, rendering the check ineffective as an access control mechanism. This makes it possible for unauthenticated attackers to invoke the wpgmp_temp_access_support handler with check_temp=false, which unconditionally creates a new WordPress user with the hardcoded role of administrator via wp_insert_user() and returns a magic login URL that, when visited, calls wp_set_auth_cookie() to fully authenticate the attacker as the newly created administrator, resulting in complete site takeover.

Back to dashboard

8.3/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-306

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Threat summary

Active exploitation appears in 46 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
69 mentions across 13 observed days

What's happening

Active exploitation reported across 46 signals
Exploit tool or code specified in 1 signal
PoC mentioned or linked in 6 signals
Patch or workaround mentioned in 29 signals
Technical details provided in 54 signals
Disclosure: 15 classified signals
Peaked 8d ago at 28 mentions (2026-06-01); latest day: 1
69 total mentions across 13 days

Deep dive

Activity timeline69 mentions / 13d

Signal classification5 categories

Active Exploitation

4463.8%

Disclosure

1521.7%

Patch

68.7%

General

34.3%

PoC

11.4%

Referenced assets53 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-28	1	Patch1
2026-05-29	1	Patch1
2026-05-30	1	Patch1
2026-05-31	7	Active Exploitation5Disclosure1Patch1
2026-06-01	28	Active Exploitation20Disclosure5General1Patch1PoC1
2026-06-02	19	Active Exploitation14Disclosure4Patch1
2026-06-03	2	Disclosure2
2026-06-04	4	Active Exploitation3General1
2026-06-06	1	Active Exploitation1
2026-06-08	1	Active Exploitation1
2026-06-09	1	Disclosure1
2026-07-12	2	Disclosure1General1
2026-07-20	1	Disclosure1

Full discourse20 posts

The Hacker News@TheHackersNews133d
Active Exploitation
⚠️ Threat actors are actively exploiting a critical vulnerability in WP Maps Pro. CVE-2026-8732 (CVSS 9.8) lets unauthenticated attackers create admin accounts and take over sites. It affects all versions up to 6.1.0. Update to 6.1.1 now. Read: https://thehackernews.com/2026/06/critical-wp-maps-pro-flaw-actively.html
Post summary
WP Maps Pro CVE‑2026‑8732, a CVSS 9.8 flaw allowing unauthenticated admin account creation, is being actively exploited. A patch (6.1.1) has been released.
33931111817.3K
1.9M followersView on X
pdnuclei-bot@pdnuclei_bot84d
Disclosure
🚨 CVE-2026-8732 - critical 🚨 WP Maps Pro (wp-google-map-gold) <= 6.1.0 - Unauthenticated Administrator Account Creation > The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Admini... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-8732 @pdn...
Post summary
The post announces a critical CVE for WP Maps Pro, detailing an unauthenticated privilege escalation vulnerability, without providing PoC, exploit code, or patch information.
012028121.3K
1.3K followersView on X
John@p3Nt3st3r_sTAr133d
PoC
https://github.com/p3Nt3st3r-sTAr/CVE-2026-8732-POC
Post summary
The provided GitHub link points to a proof‑of‑concept repository for CVE-2026-8732, confirming the existence of exploit code but offering no additional information on patches, mitigation, or active exploitation.
12025223.2K
45 followersView on X
ボス@サイバーセキュリティの専門家@boss_sec_labo131d
Active Exploitation
6月2日、2年前と19年前の脆弱性が現役で殴ってくる。 AIは43日のパッチ運用を平気で追い越す時代だ。本日11本、現場直撃のリスト。・TP-Link Archer BE450/BE7200、OSコマンド注入の脆弱性(JVN/JPCERT) ・Oracle WebLogic CVE-2024-21182、CISAがKEV登録で緊急対応・りそなHD、生成AIセキュリティリスク専門チームを社内新設・Linux Kernelに19年物の脆弱性、低権限→root取得PoC公開・HP VoIP電話CVE-2026-0826、SDP解析でroot奪取の踏み台化・WP Maps Pro CVE-2026-8732、CVSS 9.8で管理者乗っ取り進行中・IPA、OT/ICSリスク分析の講義動画をYouTubeで公開・市立奈良病院システム障害、専門家会議が初会合で原因究明へ・広島県、新聞広告QRが管理者ページ直結で86人分閲覧可能・AI悪用が中央値43日のパッチ運用を置き去り、対応自動化必須・Anthropic、防御特化AI「Claude Mythos Preview」を約150組織に拡大古傷を抱えた古い箱が、君の現場にも一台はあるはずだ。 19年前のCVEと43日のパッチ運用、君ならどちらの時計から巻き直す？
Post summary
The post lists multiple CVEs with evidence of in‑the‑wild exploitation, mentions a published PoC for a Linux kernel flaw, but does not provide specific exploit code or patch details.
0512863.7K
1.2K followersView on X
elhacker.NET@elhackernet133d
Disclosure
Vulnerabilidad en WP Maps Pro permite la creación de cuentas de administrador en sitios de WordPress Una vulnerabilidad crítica (CVE-2026-8732) en el plugin WP Maps Pro (versiones 6.1.0 y anteriores) https://blog.elhacker.net/2026/05/vulnerabilidad-en-wp-maps-pro-permite.html
Post summary
A critical vulnerability (CVE‑2026‑8732) in WP Maps Pro allows the creation of administrator accounts on affected WordPress sites, affecting versions 6.1.0 and earlier.
15020102.4K
140.9K followersView on X
ZoomEye@zoomeye_team131d
Disclosure
🚨 CVE-2026-8732: WP Maps Pro <= 6.1.0 - Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX Action Unauthenticated Admin Account Creation via Broken Nonce Protection An unauthenticated attacker exploits the publicly exposed fc-call-nonce to trigger the wpgmp_temp_access_ajax handler with check_temp=false, which silently creates a new administrator user and returns a magic login URL that grants full authenticated admin access upon visit. Full Vulnerability Details & Analysis at DarkEye: 🔗 https://darkeye.org/vuln/cve/CVE-2026-8732 🔍 Identify Targets via ZoomEye: Filter: vul.cve="CVE-2026-8732" Search Dork: app="WordPress Maps Pro Plugin" Exposure: 2.9k instances identified globally. ZoomEye Search Link: 👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJXb3JkUHJlc3MgTWFwcyBQcm8gUGx1Z2luIg==&t=all&utm_source=twitter&utm_medium=social&utm_campaign=cve_ops_20260603 #WordPress #PrivilegeEscalation #NonceBypass #WPMapsPro #ZeroAuthRCE #DarkEye #ZoomEye
Post summary
The tweet discloses a new unauthenticated privilege escalation in WP Maps Pro (CVE‑2026‑8732) that allows admin account creation via a nonce bypass, with further details linked on DarkEye.
0601363.4K
12.5K followersView on X
Teegra 🧝‍♀️𝕏@Teeegra132d
Patch
یک آسیب‌پذیری بحرانی در افزونه وردپرس WP Maps Pro با شناسه CVE-2026-8732 و امتیاز CVSS 9.8 کشف شده که به هرکس اجازه می‌دهد حساب‌های مدیریتی (administrator) جعلی ایجاد کرده و کنترل کامل سایت را در دست بگیرند. این افزونه که بیش از ۱۵,۰۰۰ بار در بازار Envato به فروش رفته، تمام نسخه‌های ۶.۱.۰ و پیش از آن را تحت تأثیر قرار می‌دهد و نسخه ۶.۱.۱ منتشرشده در ۲۰ مه ۲۰۲۶ این نقص را برطرف کرده است. ریشه این آسیب‌پذیری در قابلیت «دسترسی موقت» (temporary access) افزونه نهفته است که برای پشتیبانی فنی طراحی شده، اما به دلیل ضعف در کنترل دسترسی، امکان سوءاستفاده را فراهم می‌کند. شرکت امنیتی Wordfence اعلام کرد که تنها در ۲۴ ساعت گذشته ۲,۸۵۸ حمله مرتبط با این آسیب‌پذیری را مسدود کرده است.
Post summary
A critical CVE-2026-8732 in WP Maps Pro allows creation of fake admin accounts; the plugin’s 6.1.1 release patches the flaw, and 2,858 attacks were blocked in the last 24 hours, indicating active exploitation.
00074832
18.8K followersView on X
Today Cyber News@TodayCyberNews91d
Disclosure
👾 CVE-2026-8732: WP Maps Pro <= 6.1.0 - Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX Action Critical Vulnerability Alert! WordPress Maps Pro Plugin is affected by CVE-2026-8732. #cybersecurity #bugbounty #Vulnerability https://t.co/AbNgIlZ5YS
Post summary
The tweet announces CVE‑2026‑8732 as a critical unauthenticated privilege escalation in WordPress Maps Pro <= 6.1.0, noting the affected plugin but providing no PoC, patch, or evidence of active exploitation.
100511.4K
15.3K followersView on X
Yusuf Nuh 🍉@SenseWave_132d
Disclosure
A vulnerability in the WP Maps Pro WordPress (CVE-2026-8732) allows threat actors to create administrative accounts and take over vulnerable sites. Security defect exists in a callback AJAX function used to handle the temporary access generation, protected only by a nonce check https://t.co/NcZUt1fktR
Post summary
The tweet announces CVE-2026-8732, a WP Maps Pro vulnerability permitting attackers to create admin accounts through an insecure AJAX callback, with no mention of exploits, patches, or active attacks.
40020149
67 followersView on X
Vivek | Cybersecurity@VivekIntel133d
Disclosure
CVE-2026-8732: The WP Maps Pro Flaw That Lets Anyone Create a WordPress Admin Without a Password https://securityaffairs.com/192977/hacking/cve-2026-8732-the-wp-maps-pro-flaw-that-lets-anyone-create-a-wordpress-admin-without-a-password.html
Post summary
The article highlights CVE-2026-8732, describing a flaw in WP Maps Pro that permits anyone to create a WordPress administrator account without a password, marking the initial disclosure of a serious authentication bypass vulnerability.
00042478
12.4K followersView on X
DarkEye@darkeye_team131d
Disclosure
🚨 Detailed Analysis for CVE-2026-8732 (WP Maps Pro <= 6.1.0 - Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX Action) Stop guessing the risk. The technical details are ready. 🔥 $5 Special Trial to celebrate our CVE Feed launch! 🔗 https://darkeye.org/vuln/cve/CVE-2026-8732 Critical Risk Identified! Affects WordPress Maps Pro Plugin. cc: @zoomeye_team (2.9k targets detected 🎯) #CVE20268732 #Infosec #DarkEye #ZoomEye
Post summary
The post announces CVE‑2026‑8732 in WordPress Maps Pro, detailing the privilege‑escalation flaw, but it does not provide any PoC, exploit code, or patch information.
00031551
968 followersView on X
モーくん🐮｜WordPress × セキュリティ@accell_mo_kun131d
Active Exploitation
おはモー🐮 【WP三連発】昨日から大物が続けて来てるモー🐮 🔴 Kirki プラグイン CVE-2026-8206（CVSS 9.8）50万サイト影響、修正後も15万サイト脆弱 🔴 WP Maps Pro CVE-2026-8732 実悪用確認継続 🔴 WP約2,000件がSteamプロフィールC&C経由でマルウェア感染水曜の朝、保守クライアントの全プラグイン棚卸し1時間モー🐮 #おは戦80603js🌊 #WordPressセキュリティ
Post summary
The tweet highlights that CVE-2026-8732 is actively exploited in the wild and stresses significant impact on WordPress sites, with over 500,000 affected by another CVE, but provides no exploit code or remedies.
1003094
870 followersView on X
Elusive@ElusivePrivacy133d
Active Exploitation
WP Maps Pro Admin Account Creation (CVE-2026-8732) Attackers are exploiting a zero-auth flaw in WP Maps Pro to create rogue admin accounts on WordPress sites. One visit to a crafted URL, instant administrator access. CVE-2026-8732. ≤ v6.1.0 affected. 15,000 sites. Exploitation confirmed in the wild. Source: BleepingComputer / Wordfence Full analysis → http://t.me/VulnerabilityNews Follow @VulnerabilityNw
Post summary
The post reports confirmed wild exploitation of CVE‑2026‑8732 via a one‑click exploit that creates rogue admin accounts on affected WP Maps Pro installations.
11020515
185 followersView on X
AlexAImaginator@TraffAlex132d
Active Exploitation
🔒 CYBERSECURITY, PRIVACY & OPEN SOURCE ROUNDUP — June 02, 2026 1️⃣ GOOGLE PATCHES EXPLOITED ANDROID ZERO-DAY CVE-2025-48595 Google released its June 2026 Android Security Bulletin addressing 124 vulnerabilities, including a critical zero-day flaw (CVE-2025-48595) that is already being exploited in targeted attacks. The vulnerability is an integer overflow in the Framework layer affecting Android 14 and later, with confirmed exploitation in the wild. This marks the sixth zero-day with confirmed exploitation since September 2025, underscoring the accelerating pace of mobile threat activity. Device owners are urged to update immediately through the latest security patch. @NewsNerdie 2️⃣ ANTHROPIC EXPANDS MYTHOS AI CYBERSECURITY MODEL TO 200 ORGANIZATIONS Anthropic significantly expanded access to its Mythos cybersecurity AI research model, granting ~200 organizations across power, healthcare, communications, and critical software maintenance sectors the ability to use it. The model has already identified over 10,000 serious software vulnerabilities since its initial release. The EU cybersecurity agency ENISA was also granted access, signaling growing institutional trust in AI-driven vulnerability detection. This represents a major shift toward AI-augmented security operations at scale. @FuturumEquities 3️⃣ ORACLE WEBLOGIC CVE-2026-21962 — CVSS 10.0 RCE ACTIVELY EXPLOITED A critical remote code execution vulnerability in Oracle WebLogic Server (CVE-2026-21962, CVSS 10.0) is being actively exploited in the wild. The flaw allows unauthenticated attackers to achieve RCE via path traversal in the HTTP Server/Proxy Plugin component. Given Oracle WebLogic's widespread deployment in enterprise environments, this poses an immediate and severe risk. Organizations running WebLogic should prioritize patching or deploy compensating controls without delay. @ThreatAft 4️⃣ RED HAT NPM PACKAGES COMPROMISED IN SUPPLY-CHAIN ATTACK More than 30 npm packages under Red Hat's "@redhat-cloud-services" namespace were compromised in a supply-chain attack distributing a new variant of the Shai-Hulud credential-stealing malware. The malicious packages were designed to harvest developer credentials during installation. This incident highlights the persistent risk of package repository compromises and reinforces the need for strict dependency auditing and signed package verification in development workflows. @TechKimmi 5️⃣ WORDPRESS WP MAPS PRO VULNERABILITY BLOCKS 2,800+ ATTACKS IN 24 HOURS A critical vulnerability in the WP Maps Pro WordPress plugin (CVE-2026-8732) allows unauthenticated attackers to create admin-level accounts. Within a single day, over 2,800 exploitation attempts were recorded and blocked by security monitoring services. The fix is available in version 6.1.1. With WordPress powering 43% of all websites, plugin vulnerabilities like this remain one of the most common attack vectors against web infrastructure. @dailytechonx 6️⃣ HP POLY VOICE PHONES VULNERABLE TO ROOT-LEVEL RCE HP Poly Voice VVX and Trio IP phones are affected by a critical flaw (CVE-2026-0826) that enables root-level remote code execution through malicious SIP/SDP traffic when ICE is enabled. This vulnerability can serve as an entry point for broader enterprise network compromise, as VoIP phones are often deployed on the same network segments as corporate devices. Organizations using affected devices should apply vendor patches or disable ICE functionality as an interim measure. @TweetThreatNews 7️⃣ MINECRAFT MALWARE-AS-A-SERVICE: MCAFEE REPORTS WEEDHACK CAMPAIGNS McAfee published a detailed analysis of "WeedHack," a sophisticated Malware-as-a-Service campaign targeting Minecraft players. The operation uses fake Minecraft mods and servers to distribute malware, demonstrating how threat actors increasingly leverage popular gaming platforms to reach younger audiences. The report outlines the full infection chain, infrastructure, and monetization methods behind the campaign, serving as a case study in how gaming communities are being weaponized for cybercrime. @AndreGironda 💭 The cybersecurity landscape in early 2026 shows a clear trend: vulnerabilities are being discovered and exploited faster than ever. From Oracle's CVSS 10.0 WebLogic flaw being weaponized immediately, to Red Hat's own npm supply chain being compromised, the window between disclosure and exploitation continues to shrink. The good news is that AI tools like Anthropic's Mythos are scaling up to meet this challenge, identifying tens of thousands of vulnerabilities before attackers can find them. The race is between automated discovery and automated exploitation — and the side that moves faster wins. Which cybersecurity development surprised you the most this week? Share your thoughts 👇 #Cybersecurity #InfoSec #ZeroDay #OpenSource #Privacy #ThreatIntelligence
Post summary
The roundup confirms multiple CVEs are actively being exploited and urges immediate patching, illustrating the rapid transition from disclosure to real-world attacks in recent weeks.
10020201
2.7K followersView on X
Misbar | مسبار@MisbarSec132d
Active Exploitation
📌 ثغرة CVE-2026-8732 في WP Maps Pro تسمح بإنشاء حسابات إدارة ووردبريس بدون كلمة مرور تم اكتشاف ثغرة أمنية في WP Maps Pro، وهي إضافة لووردبريس تسمح بإنشاء حسابات إدارة بدون كلمة مرور. حدثت 2858 هجمات محظورة في 24 ساعة. تم تثبيت الإضافة على أكثر من 15000 موقع، مما يعرضهم للخطر. يُنصح بتحديث الإضافة إلى أحدث إصدار وتفعيل التحديثات الأمنية. 🔗 للمزيد: https://securityaffairs.com/?p=192977
Post summary
CVE-2026‑8732 in WP Maps Pro permits password‑less WordPress admin account creation; over 2,800 attacks were blocked in a single day, urging users to update the plugin immediately.
000301.5K
215 followersView on X
Rohan Takke@takkerohan97132d
Active Exploitation
A WordPress plugin’s “support access” feature just became a free admin key for attackers😱 CVE-2026-8732 in WP Maps Pro: → No login needed → Anyone can call the endpoint → It creates a full admin account → Returns a magic login URL on the spot → Complete site takeover in seconds 15,000+ sites affected. 2,858 attacks blocked in just 24 hours. If you’re running WP Maps Pro — update to 6.1.1 NOW. Read : https://securityaffairs.com/192977/hacking/cve-2026-8732-the-wp-maps-pro-flaw-that-lets-anyone-create-a-wordpress-admin-without-a-password.html
Post summary
CVE‑2026‑8732 in WP Maps Pro is actively exploited, enabling attackers to create admin accounts without authentication; a patch is available and recommended.
01020113
365 followersView on X
Today Cyber News@TodayCyberNews91d
General
- Identify Targets via @zoomeye_team : Filter: vul.cve="CVE-2026-8732" Search Dork: app="WordPress Maps Pro Plugin" Exposure: 2.9k instances identified globally. ZoomEye Search Link: https://www.zoomeye.ai/searchResult?q=YXBwPSJXb3JkUHJlc3MgTWFwcyBQcm8gUGx1Z2luIg==&t=host&utm_source=telegram&utm_medium=community&utm_campaign=cve_ops_20260603
Post summary
The post reports that 2.9k WordPress Maps Pro installations may have CVE‑2026‑8732, but provides no exploitation details, patches, or confirmation of actual usage; it is a general reconnaissance notice.
00011334
15.3K followersView on X
كاسبر سكاي@KasperskyDev130d
Active Exploitation
ثغرة حرجة في إضافة WP Maps Pro تتيح لمهاجم غير مصادَق إنشاء حساب مدير على ووردبريس، واستُغلت 3,600 مرة في يوم واحد المعرّف : CVE-2026-8732 درجة الخطورة : 9.8 - Critical الإصدارات المتأثرة : WP Maps Pro <= 6.1.0 الحل : Upgrade to 6.1.1 #CVE #WordPress #CVE20268732
Post summary
CVE-2026-8732 is a critical flaw in WP Maps Pro that was actively exploited—allowing attackers to create admin accounts—and is remediated by upgrading to version 6.1.1.
11000182
40.0K followersView on X
Jim Nitterauer 🇺🇸@JNitterauer131d
Active Exploitation
⚠️ WordPress WP Maps Pro plugin (CVE-2026-8732, CVSS 9.8) is being actively exploited — attackers create admin accounts with ZERO credentials. Update now & audit your admin users. #WordPress #cybersecurity #WebSecurity https://www.bleepingcomputer.com/
Post summary
The WP Maps Pro plugin CVE-2026-8732 is actively being exploited to create admin accounts without credentials; users should promptly update the plugin and audit administrative accounts.
01001152
8.5K followersView on X
Threatwhere@threatwhere132d
Active Exploitation
🔐 CANADA: BrainCipher ransomware group conducted cyberattack against telecommunications provider at 21:59 UTC, disrupting critical digital services. Concurrent exploitation of CVE-2026-8732 affected 15,000+ WordPress sites. #Canada #Cybersecurity #CyberAttack #ThreatIntel #Threatwhere 🌐 https://threatwhere.com
Post summary
The tweet confirms CVE‑2026‑8732 is actively exploited against thousands of WordPress sites, with no PoC, exploit code, patch, or technical details provided.
0002088
269 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-8732

John[verified]@p3Nt3st3r_sTArPoC

The provided GitHub link points to a proof‑of‑concept repository for CVE-2026-8732, confirming the existence of exploit code but offering no additional information on patches, mitigation, or active exploitation.

ボス@サイバーセキュリティの専門家[verified]@boss_sec_laboActive Exploitation

The post lists multiple CVEs with evidence of in‑the‑wild exploitation, mentions a published PoC for a Linux kernel flaw, but does not provide specific exploit code or patch details.

ZoomEye[verified]@zoomeye_teamDisclosure

The tweet discloses a new unauthenticated privilege escalation in WP Maps Pro (CVE‑2026‑8732) that allows admin account creation via a nonce bypass, with further details linked on DarkEye.

Teegra 🧝‍♀️𝕏[verified]@TeeegraPatch

A critical CVE-2026-8732 in WP Maps Pro allows creation of fake admin accounts; the plugin’s 6.1.1 release patches the flaw, and 2,858 attacks were blocked in the last 24 hours, indicating active exploitation.

Vivek | Cybersecurity[verified]@VivekIntelDisclosure

The article highlights CVE-2026-8732, describing a flaw in WP Maps Pro that permits anyone to create a WordPress administrator account without a password, marking the initial disclosure of a serious authentication bypass vulnerability.

DarkEye[verified]@darkeye_teamDisclosure

The post announces CVE‑2026‑8732 in WordPress Maps Pro, detailing the privilege‑escalation flaw, but it does not provide any PoC, exploit code, or patch information.

モーくん🐮｜WordPress × セキュリティ[verified]@accell_mo_kunActive Exploitation

The tweet highlights that CVE-2026-8732 is actively exploited in the wild and stresses significant impact on WordPress sites, with over 500,000 affected by another CVE, but provides no exploit code or remedies.

Elusive[verified]@ElusivePrivacyActive Exploitation

The post reports confirmed wild exploitation of CVE‑2026‑8732 via a one‑click exploit that creates rogue admin accounts on affected WP Maps Pro installations.