CVE-2026-8935 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-8935 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-8935 is an unauthenticated authorization bypass vulnerability in the WP MAPS PRO WordPress plugin affecting versions prior to 6.1.1, exposing sites to unauthorized AJAX action execution via a publicly accessible nonce.

Technical Detail

The plugin registers an AJAX action that can be invoked without authentication; the only protection is a nonce check, but that nonce is emitted in plaintext on any frontend page that loads the plugin's map script, making it trivially obtainable by any visitor. An attacker can retrieve the nonce from a public page and then call the unprotected AJAX endpoint unconditionally, bypassing the intended access control entirely. Depending on what the AJAX handler performs, this could result in unauthorized data access, data manipulation, or further privilege escalation within the WordPress installation.

Exploitation Status

No known exploit code has been identified at this time, and this CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is assessed as none, meaning no public proof-of-concept or weaponized tooling has been confirmed as of June 22, 2026. However, the low barrier to exploitation, requiring only a valid nonce retrievable from any public page, means the effective difficulty for a motivated attacker is minimal.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor involvement has been identified in connection with this vulnerability.

What To Do

Update the WP MAPS PRO plugin to version 6.1.1 or later immediately. Given the critical CVSS score of 9.8 and the unauthenticated nature of the attack vector, patching should be treated as high priority regardless of the current absence of known exploits. Site administrators who cannot patch immediately should consider temporarily deactivating the plugin or restricting access to WordPress AJAX endpoints via web application firewall rules targeting the specific action registered by the plugin. Monitor server logs for anomalous or high-volume requests to wp-admin/admin-ajax.php originating from unauthenticated sessions as a detection signal.