VulnSocial

CVE-2026-8935Disclosure

LOWCVSS 9.8 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuing its map script, unconditionally creates an administrator account and returns a magic-login URL granting interactive admin access.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 5 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 5 signals
  • Disclosure: 4 classified signals
  • Peaked 1d ago at 3 mentions (2026-06-15); latest day: 2
  • 5 total mentions across 2 days

Deep dive

Activity timeline5 mentions / 2d
01223Mentions · 2026-06-15: 3Mentions · 2026-06-16: 2Patch / Workaround · 2026-06-16: 1Technical Details · 2026-06-15: 3Technical Details · 2026-06-16: 206-1506-16
Signal classification2 categories
Disclosure
480.0%
Patch
120.0%
Referenced assets6 URLs
Classification over time
DateTotalLabels
2026-06-153
Disclosure3
2026-06-162
Disclosure1Patch1
Full discourse5 posts
  • ThreatCluster@threatcluster
    Disclosure

    CVE-2026-8935, a CVSS 9.8 flaw in the WP MAPS PRO WordPress plugin, lets unauthenticated users create administrator accounts and gain interactive access, http://Lyrie.Ai reported. https://threatcluster.io/cluster/critical-vulnerabilities-disclosed-cve-2026-8935-and-cve-202-e03fcc03

    Post summary

    The text announces CVE‑2026‑8935, a high‑severity flaw in WP MAPS PRO that allows unauthenticated users to create admin accounts and gain interactive access, marking it as a disclosure of a critical vulnerability.

    0000051
    348 followersView on X
  • ADK Cyber@ADKCyber
    Patch

    CVE-2026-8935 (CVSS 9.8) impacts WP MAPS PRO plugin before 6.1.1. Update immediately if in use. via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability https://t.co/Tplx9UwV0q

    Post summary

    High‑severity vulnerability (CVSS 9.8) in WP MAPS PRO plugin before 6.1.1; users are urged to update immediately.

    0000049
    90 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-8935 The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuin… https://www.cve.org/CVERecord?id=CVE-2026-8935 ----- Traducción: CVE-2026-8935 El … http://infoflow.cloud`

    Post summary

    The post announces CVE‑2026‑8935 as an unauthenticated AJAX action flaw in WP MAPS PRO, providing a brief technical description but no PoC, exploit, or patch details.

    0000070
    79 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-8935 The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuin… https://www.cve.org/CVERecord?id=CVE-2026-8935

    Post summary

    The CVE records a flaw in WP MAPS PRO plugin allowing unauthenticated AJAX calls with a publicly visible nonce, but no exploit code, patch, or exploitation reports are mentioned.

    00000263
    57.6K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-8935 Unauthenticated Administrator Account Creation in WP MAPS PRO Word... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-8935 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4

    Post summary

    The tweet announces CVE-2026-8935, an unauthenticated admin account creation flaw in WP MAPS PRO, with no evidence of PoC, exploit code, or active exploitation.

    0000049
    4.0K followersView on X

Explore more

Back to dashboard