Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-08-26
WP MAPS PRO - Path Traversal (CVE-2026-18465)
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include and execute arbitrary existing local PHP files on the server.
PLUGIN
WP MAPS PRO
CVE-2026-18465
Risk Score
Threat Entry
Updated 2026-08-26
WP MAPS PRO - Denial of Service (CVE-2026-18464)
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.
PLUGIN
WP MAPS PRO
CVE-2026-18464
Risk Score
Threat Entry
Updated 2026-07-23
WP MAPS PRO - Security Vulnerability (CVE-2026-8935)
The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuing its map script, unconditionally creates an administrator account and returns a magic-login URL granting interactive admin access.
PLUGIN
WP MAPS PRO
CVE-2026-8935
Risk Score
Threat Entry
Updated 2026-07-21
WP Maps Pro - Privilege Escalation (CVE-2026-8732)
The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ and protected only by a nonce check using the fc-call-nonce nonce, which is publicly embedded into every frontend page via wp_localize_script as the nonce field of the wpgmp_local JavaScript object, rendering the check ineffective as an access control mechanism. This makes it possible for unauthenticated attackers to invoke the wpgmp_temp_access_support handler with check_temp=false, which…
PLUGIN
WP Maps Pro
CVE-2026-8732
Risk Score