A critical vulnerability, designated as CVE-2026-8732, has been discovered in the WP Maps Pro plugin, which is installed on over 15,000 websites, allowing unauthenticated attackers to create WordPress admin accounts without a password1. The plugin, used for embedding Google Maps and OpenStreetMap with store locator functionality, has been found to be vulnerable to exploitation, with 2,858 attacks blocked in a 24-hour period. The flaw enables attackers to create full administrator accounts on affected sites without prior login credentials. As a result, websites using the WP Maps Pro plugin are at risk of unauthorized access and potential data breaches. The active exploitation of this vulnerability is being closely monitored, with discussions involving Google to determine the severity of the threat. This vulnerability matters to practitioners as it underscores the need for immediate patching or close monitoring to prevent potential security breaches.