The vulnerability allows an attacker to create a new administrator account without any authentication, using a publicly accessible AJAX endpoint that requires only a valid nonce. The new account is granted full administrative privileges and the system returns a magic-login URL that enables the attacker to access the dashboard interactively, essentially leading to a full administrative compromise of the affected WordPress site.

WP MAPS PRO WordPress plugin, versions prior to 6.1.1. Any website running this plugin before the release of version 6.1.1 is vulnerable. The vulnerability is triggered through an unauthenticated AJAX action that is exposed on any frontend page where the plugin’s map script is enqueued.

Because the AJAX endpoint is publicly reachable and only requires a nonce that can be extracted from the frontend, attackers can exploit this flaw with minimal effort. The EPSS score is currently not available, and the vulnerability is not listed in the CISA KEV catalog, but the severity implied by the creation of privileged accounts indicates a high risk. Exploitation requires no special access; simply visiting a site using the vulnerable plugin and capturing the nonce will suffice, after which the attacker can activate the magic-login URL and control the site.