WP Maps Pro plugin under active attack via admin account creation flaw

Affected Systems

WP Maps Pro WordPress plugin (version details not specified). Affects WordPress sites with the plugin installed. Vulnerability allows unauthenticated attackers to create administrator accounts.

Exploitation Status

Active exploitation confirmed. Attackers are creating rogue administrator accounts on vulnerable WordPress sites in the wild.

Business Impact

Complete site compromise. Attackers gain full administrative control over WordPress installations, enabling data theft, malware injection, defacement, SEO spam, or use as attack infrastructure. No authentication required. CVE not yet assigned; patch status unknown.

Urgency

🔴 Immediate

Recommended Actions

• Immediately disable or uninstall WP Maps Pro plugin on all WordPress sites until vendor releases a patch
• Audit all WordPress administrator accounts for unauthorized entries created recently; remove any rogue accounts
• Review WordPress access logs and database audit logs for suspicious user creation activity (wp_users table modifications)
• If WP Maps Pro is business-critical, isolate affected sites behind WAF rules blocking unauthenticated POST requests to plugin endpoints
• Monitor vendor communications for security update and apply immediately when available