Attackers Hammer WP Maps Pro Flaw to Mint Admin Accounts on WordPress Sites
A critical bug in the 15,000-install Envato plugin is being weaponized in the wild to seed rogue administrators.
Key points
- Threat actors are actively exploiting a critical, unauthenticated vulnerability in WP Maps Pro, a commercial WordPress plugin.
- Successful exploitation lets a visitor escalate directly to full site administrator without logging in.
- The plugin has over 15,000 sales on Envato Market, making the attack surface broad.
- Attackers are provisioning rogue admin accounts and adding secondary emails to maintain persistence.
- Envato-distributed plugins lack a central auto-update channel, slowing patch adoption across the installed base.
What is the WP Maps Pro vulnerability?
Threat actors are actively exploiting a critical flaw in WP Maps Pro, a WordPress plugin sold through Envato Market with over 15,000 sales, to create rogue administrator accounts on unpatched sites. The plugin lets site owners embed customizable Google Maps and OpenStreetMap views with markers and location features. No authentication is required to exploit the flaw: an unauthenticated visitor can escalate straight to full administrator.
From that position, the follow-on activity is routine. Backdoor uploads, SEO spam, redirects to scam infrastructure, data theft from membership or commerce extensions running alongside. Operators typically rename the rogue account to blend with legitimate users, then register a secondary email for persistence.
Why are Envato plugins slow to patch?
The pattern is familiar. A premium plugin with strong sales ships a vulnerable endpoint, researchers or the vendor publish a fix, and mass scanning begins within hours, often before owners have noticed an update exists. Envato-distributed plugins don't have a central auto-update channel comparable to the wordpress.org repository, so patches propagate slowly across the installed base.
We first covered a WP Maps Pro vulnerability on 1 June 2026. The distribution problem hasn't changed since then.
Who is behind the campaign?
Attribution is not yet established. The technique, automated mass exploitation followed by admin provisioning, is the standard approach for financially motivated crews that monetize compromised WordPress estates through traffic redirection and card skimming on WooCommerce stores. Some of those access brokers later resell footholds to ransomware affiliates targeting the underlying hosting environments.
No ransom demands are tied to this activity directly. Monetization comes downstream through access resale and parasitic traffic. For affected operators, the practical cost is the same: incident response, customer notification where personal data is involved, and the slow work of rebuilding search-engine trust after a redirect campaign.
Should you worry about indicators of compromise?
Yes. Indicators circulating in researcher channels include admin usernames in randomized patterns and login activity from hosting-provider IP ranges linked to prior WordPress mass-exploitation campaigns. WP Maps Pro buyers should treat sites as exposed until they've confirmed otherwise.
Recommended steps: update WP Maps Pro to the latest version available through CodeCanyon immediately; audit the WordPress users table for administrator accounts created in the last 30 days, particularly those with unfamiliar email domains; review the wp_options table and active plugin list for unexpected additions; rotate all administrator passwords and invalidate active sessions.
Threat Vectr will update as patch adoption data and attribution develop.
