Jenderal92/CVE-2026-8732

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python 2.7 script that exploits CVE-2026-8732 in WP Maps Pro. It extracts a publicly available nonce, sends a crafted AJAX request to obtain a magic login token, then uses the authenticated session to create a new administrator user via the WordPress admin panel, resulting in full site takeover.

Backdoor review

No backdoor observed in reviewed code

The supplied PoC is a Python 2.7 script that exploits CVE-2026-8732 by extracting a nonce, obtaining a token via an AJAX endpoint, and then creating a new administrator user on vulnerable WordPress sites. All observed behavior is consistent with the stated exploit purpose. No concealed backdoor, unrelated payload, or operator-directed harm was found in the reviewed text files.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareWP Maps ProWordPress
Attack typesprivilege escalationaccount creation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits the vulnerability by obtaining a token and then creating a new administrator account on the target system. It goes beyond detection or scanning by performing the full privilege escalation chain, including account creation and credential persistence.

CVE-2026-8732.py:165-233README.md:8-10

Requirements

  • Target must be running a vulnerable version of WP Maps Pro (<= 6.1.0) with the wpgmp_temp_access_ajax endpoint exposed.CVE-2026-8732.py:182-188
  • The target's frontend must embed the fc-call-nonce or wpgmp_local nonce in the page source.CVE-2026-8732.py:40-45

Observed behavior

  • Extracts a nonce from the target's homepage HTML by searching for wpgmp_local or fc-call-nonce patterns.CVE-2026-8732.py:34-48
  • Sends a POST request to /wp-admin/admin-ajax.php with action=wpgmp_temp_access_ajax, the extracted nonce, and check_temp=false to obtain a magic login token.CVE-2026-8732.py:182-201
  • Parses the AJAX response to extract a token and an optional redirect URL, then visits the redirect URL to establish an authenticated session.CVE-2026-8732.py:77-109CVE-2026-8732.py:210-216
  • Uses the authenticated session to access /wp-admin/user-new.php, extracts the create-user nonce, and submits a form to create a new administrator user with a hardcoded password.CVE-2026-8732.py:111-163
  • Saves the created administrator credentials (domain, username, password, email) to admin_created.txt.CVE-2026-8732.py:63-75
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Credential Creation
Hardcoded admin credentials: username 'securityaudit_<timestamp>', password 'StrongP@ssw0rd123!', email 'audit@example.com'The script creates a new administrator account on the target site using these hardcoded values. This is the intended exploit outcome described in the CVE and README.CVE-2026-8732.py:18-20CVE-2026-8732.py:218-223
File Output
Output files: 'res.txt' and 'admin_created.txt'The script writes discovered tokens and created admin credentials to local files. This is standard PoC logging and does not indicate exfiltration to an external party.CVE-2026-8732.py:15-16CVE-2026-8732.py:50-75
Network Request
POST to /wp-admin/admin-ajax.php with action=wpgmp_temp_access_ajaxThis is the vulnerable AJAX endpoint described in the CVE. The script sends the extracted nonce and handler parameters to trigger the privilege escalation.CVE-2026-8732.py:182-201
Review boundaries

What the analysis did not establish

  • The evidence consists of static source code and documentation; the code was not executed, so its actual behavior and reliability are not verified.
  • The README.md contains minor inaccuracies (e.g., refers to 'WP Google Map Pro' and version '1.5.0' instead of 'WP Maps Pro' and '6.1.0'), but the code targets the correct CVE.
  • Only the two text files (CVE-2026-8732.py and README.md) were reviewed; no binary or other file types were present in the evidence packet.
  • The review does not assess whether the exploit works as claimed or whether the target plugin is actually vulnerable.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1