The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This …

The WP Maps Pro WordPress plugin contains a critical privilege escalation vulnerability in versions up to 6.1.0. The vulnerability allows unauthenticated attackers to create administrator accounts through an improperly secured AJAX action. The wpgmp_temp_access_ajax action is protected only by a publicly accessible nonce, making the security check ineffective. Attackers can exploit this to invoke wpgmp_temp_access_support with check_temp=false, automatically creating a new administrator user and receiving a magic login URL for complete site takeover.