WP Maps Pro up to version 6.1.0 contains an authentication bypass that allows an attacker to create an administrator user without any credentials. The flaw originates from the wpgmp_temp_access_ajax AJAX action, which is registered for unauthenticated access and only checks a nonce that is publicly revealed in every front‑end page. Because the check is ineffective, a request can trigger the wp_insert_user() call with a hard‑coded administrator role and the plugin then returns a magic login URL that, when visited, logs the attacker in as that new user. This is a classic example of CWE‑306, missing authentication. The direct consequence is total control of the WordPress site, including all content, settings, and other user accounts.

All installations of WP Maps Pro, version 6.1.0 or older, are affected. Users who have not applied the latest patch or upgraded past 6.1.0 are at risk of unauthenticated privilege escalation.

The CVSS score of 9.8 reflects critical severity, with a full impact on confidentiality, integrity, and availability of the WordPress instance. While no EPSS score is available, the lack of a KEV listing indicates no widespread exploitation has been reported yet. The weakest point is a public AJAX endpoint; any visitor can send the malicious request, making the vulnerability trivial to exploit if the attacker discovers it. The attack requires no credentials and requires only a crafted HTTP POST to the vulnerable endpoint, after which the attacker obtains full administrator access immediately.