CVE-2026-8732 in WP Maps Pro lets unauthenticated attackers create WordPress admin accounts. 2,858 attacks blocked in 24 hours.
WP Maps Pro plugin allows WordPress site owners to embed Google Maps and OpenStreetMap with markers, listings, and location search. It’s a store locator tool. Unremarkable. The plugin is installed on over 15,000 websites, according to sale data of Envato Market. And right now, attackers are actively exploiting a critical flaw in it that lets anyone on the internet create a full administrator account on an affected site without logging in first.
The vulnerability is tracked as CVE-2026-8732 and received a CVSS score of 9.8. The root cause is a “temporary access” feature built to let plugin support staff log into a customer’s site during troubleshooting. That feature registered an AJAX action called wpgmp_temp_access_ajax using WordPress’s wp_ajax_nopriv_ hook, which means unauthenticated users can call it. The only protection was a nonce check, but the nonce itself was embedded publicly into every frontend page of the site via wp_localize_script.
“This makes it possible for unauthenticated attackers to invoke the wpgmp_temp_access_support handler with check_temp=false, which unconditionally creates a new WordPress user with the hardcoded role of administrator via wp_insert_user() and returns a magic login URL that, when visited, calls wp_set_auth_cookie() to fully authenticate the attacker as the newly created administrator, resulting in complete site takeover.” reads the report published by WordPress security firm WordPress.
The design is almost impressive in how thoroughly it fails. A nonce is meant to prevent cross-site request forgery, not control access. Using it as an authentication gate for a publicly accessible endpoint is like locking a door with a key you’ve taped to the outside.
“This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ and protected only by a nonce check using the fc-call-nonce nonce, which is publicly embedded into every frontend page via wp_localize_script as the nonce field of the wpgmp_local JavaScript object, rendering the check ineffective as an access control mechanism.” states the report.
Security researcher David Brown discovered and reported the vulnerability through the Wordfence Bug Bounty Program. He earned a bounty of $1,950.00 for his submission.
The plugin maintainers addressed the issue on May 20, 2026, with the release of version 6.1.1. The fix is straightforward: the endpoint now requires the requesting user to already be an authenticated administrator before it’ll do anything. All versions up to and including 6.1.0 remain vulnerable.
However, Wordfence researchers observed that the active exploitation started before most site owners had time to patch.
“Wordfence blocked 2,003 attacks targeting this vulnerability in the past 24 hours.” reports the cybersecurity firm.
That’s a fast ramp from disclosure to mass exploitation, which is consistent with how WordPress plugin vulnerabilities tend to move once a working proof-of-concept circulates. The attack surface is wide: 15,000 sales on Envato Market, and many WordPress site owners don’t update plugins on any predictable schedule.
If you’re running WP Maps Pro, update to 6.1.1 immediately. If you can’t update right now, deactivate the plugin entirely until you can. An attacker who’s already created an admin account on your site has full control: they can install backdoors, redirect traffic, inject malware into your pages, or simply exfiltrate whatever data the site holds. The update takes thirty seconds. The cleanup after a full site takeover does not.
When it comes to content, there’s little I love more than a good, gritty crime drama. From their dark, cynical, often realistic portrayals of criminal underworlds, violence, and justice systems to their heavily flawed, obsessed, anti-hero protagonists and intense, gritty tones, it all sucks us in, and it’s why we can’t look away. These types of criminal shows have carved out a powerful space in television by refusing to glamorize the worlds they depict and being willing to confront uncomfortable truths.
This weekend on Amazon Prime Video in the U.S., we’re exploring three immensely popular, critically acclaimed criminal shows that will hook you from the get-go with their honesty, and my top pick is a must-see that reinvented the police procedural genre.
3
City on a Hill
A Wire-like look at corruption, race, and justice
Based on a story by Ben Affleck and author Charlie MacLean, the underrated crime drama City on a Hill revisits a charged moment in Massachusetts history known as The Boston Miracle. For 18 months in the mid-90s, gang-related violence dropped 63% as the result of a community-wide initiative developed in collaboration with the Boston Police Department, street workers, juvenile corrections officers, churches, and neighborhood programs. Kevin Bacon (Footloose), Aldis Hodge (Cross), and Jonathan Tucker (Kingdom) headline the cast.
Set in early 1990s Boston, corruption, violent criminals, and racism are normal parts of life, and to make matters worse, they’re backed by local law enforcement agencies. The series focuses on an unlikely alliance between hardened, corrupt, charismatic FBI agent Jackie Rohr (Bacon) and idealistic Assistant District Attorney Decourcy Ward (Hodge) as they work together to navigate the city and take down a family of armored car thieves, aiming to overhaul the broken criminal justice system.
Quiz
8 Questions · Test Your Knowledge
Prime Video movies Trivia challenge
From thrillers to tearjerkers — see how well you know these Amazon Prime Video films.
DramaThrillerTrue StoryComedySports
In Crime 101, what profession does the main character use as cover while pulling off elaborate heists?
That’s right! The protagonist poses as a real estate agent, using the job’s access and mobility as a convenient front for criminal activity. The film plays with how ordinary professions can mask extraordinary deception.
Not quite — the correct answer is real estate agent. The film uses this cover cleverly, showing how a respectable-seeming profession can provide the perfect camouflage for a career criminal operating in plain sight.
In Saltburn, which prestigious English university does protagonist Oliver Quick attend when he befriends Felix Catton?
Correct! Oliver and Felix meet at Oxford, where the stark class divide between scholarship student Oliver and the aristocratic Felix is immediately established. That university setting is crucial to the film’s themes of privilege and obsession.
Not quite — it’s Oxford where Oliver and Felix first cross paths. Director Emerald Fennell deliberately chose Oxford’s world of old money and social stratification to set up the film’s exploration of class envy and manipulation.
In The Tender Bar, based on J.R. Moehringer’s memoir, who plays Uncle Charlie, the bartender who becomes a father figure to young J.R.?
Spot on! Ben Affleck plays the warm and charismatic Uncle Charlie, earning considerable praise for the role. Affleck’s performance was seen as one of the film’s greatest strengths, bringing real depth to a man who shapes a fatherless boy’s entire worldview.
The correct answer is Ben Affleck. His portrayal of Uncle Charlie was widely praised as a career highlight, capturing the rough charm of a bartender who becomes the most important male role model in J.R.’s life.
In the 2024 Prime Video remake of Road House, who plays ex-UFC fighter Elwood Dalton, the new bouncer at a Florida Keys roadhouse?
That’s right! Jake Gyllenhaal steps into the role made famous by Patrick Swayze, playing a disgraced MMA fighter hired to clean up a rowdy bar in the Florida Keys. Gyllenhaal underwent intense physical training to prepare for the action-heavy role.
The correct answer is Jake Gyllenhaal. He took on the iconic role previously played by Patrick Swayze in the 1989 original, with the remake shifting the setting from Missouri to the Florida Keys and updating the protagonist’s fighting background to MMA.
Thirteen Lives depicts the dramatic 2018 rescue of a youth soccer team trapped in a cave in which country?
Correct! The film recreates the harrowing rescue of the Wild Boars youth soccer team from the Tham Luang cave in Thailand. The real-life operation captivated the world and involved expert cave divers from across the globe.
The answer is Thailand. The real rescue took place in the Tham Luang Nang Non cave in Chiang Rai province, where 12 boys and their coach were trapped for 18 days before a multinational team of divers managed to bring them all out safely.
In Manchester by the Sea, what unexpected event forces Lee Chandler to return to his hometown and become guardian of his teenage nephew?
That’s right! Lee’s brother Joe dies suddenly from congestive heart failure, pulling Lee back to a town filled with painful memories. Casey Affleck won the Academy Award for Best Actor for his portrayal of the grief-stricken, emotionally closed-off Lee.
Not quite — Lee returns because his brother Joe dies of congestive heart failure. The film, written and directed by Kenneth Lonergan, won two Academy Awards including Best Original Screenplay, and is celebrated for its unflinching portrayal of grief and guilt.
In American Fiction, what pen name does frustrated author Thelonious ‘Monk’ Ellison use when he writes a satirical novel pandering to racial stereotypes?
Correct! Monk writes his outrageous satirical manuscript under the pseudonym Stagg R. Leigh, a name that itself plays on stereotypes. The film, based on Percival Everett’s novel Erasure, won Cord Jefferson the Academy Award for Best Adapted Screenplay.
The pen name Monk uses is Stagg R. Leigh. The choice of pseudonym is itself part of the satire — a name loaded with cultural baggage. Jeffrey Wright received an Academy Award nomination for Best Actor for his nuanced portrayal of Monk.
In Air, the film about Nike signing Michael Jordan, which actress plays Jordan’s mother Deloris, who plays a pivotal role in negotiating his landmark deal?
That’s right! Viola Davis plays Deloris Jordan with commanding presence, portraying her as the savvy negotiator who helped secure the revolutionary contract that gave Michael unprecedented royalties. The real Deloris Jordan is widely credited with shaping the deal that changed sports marketing forever.
The correct answer is Viola Davis. She received widespread praise for capturing the intelligence and determination of Deloris Jordan, whose behind-the-scenes negotiations were instrumental in creating the Air Jordan brand that would go on to generate billions of dollars.
Challenge Complete
Your Score
/ 8
Thanks for playing!
Expect a thick atmosphere of 90s Boston authenticity, compelling power dynamics, character-driven narratives, and exceptional acting, particularly from Bacon, who gives a career-best performance. The show offers a serious, slow-burn exploration of one city’s criminal justice system while blending police corruption with family drama and social issues. Though fictionalized, it’s a fascinating look at Boston’s transition from a corrupt era to a new system and is executive produced by Affleck and Matt Damon.
2
River
A traditional “whodunit” investigation
Boasting a perfect critics’ score on Rotten Tomatoes, River is a six-part British police procedural and psychological crime drama about a haunted detective investigating his partner’s murder while also struggling with his mental health. Stellan Skarsgård (Good Will Hunting) and Nicola Walker (Unforgotten) star.
Detective Inspector John River (Skarsgård) is brilliant at what he does, but his fractured mind keeps him trapped between the living and the dead, haunted by “manifests,” or visions of murder victims, including his recently deceased partner, Stevie. Under enormous pressure from the media and psychiatric evaluation for his hallucinations, River works hard to navigate his guilt and, in the process, discovers the shocking truth about Stevie’s death.
Unlike typical crime shows, River focuses heavily on its protagonist’s mental states in the wake of his criminal experiences. The slow-burn, dramatic crime thriller is characterized by intense psychological scenes, a traditional “whodunit” investigation, and a masterful performance from Skarsgård. Expect a deeply human study of loss with smart writing, a genuinely creepy atmosphere, and a unique, emotional take on the police procedural drama.
1
The Shield
One of the best cop shows ever made
One of this century’s best crime dramas, The Shield is a multi-Golden Globe and Primetime Emmy Award winner. Michael Chiklis (The Commish), Walton Goggins (The White Lotus), Kenny Johnson (Ray), and Michael Jace (The Replacements) star alongside an enormous cast that includes Forest Whitaker, Katey Sagal, Kurt Sutter, CCH Pounder, Glenn Close, Benito Martinez, and more.
The hit FX show follows the corrupt activities of rogue cop Vic Mackey (Chiklis) in an experimental criminal division task force of the Los Angeles Police Department. He’ll go to any lengths to take down the criminals he and his team are chasing, including breaking the law and working with other criminals, and eventually he ropes his team into doing the same. Everything is set in a district rife with gang-related violence, drug trafficking, and prostitution.
Highly regarded for reinventing the police procedural and setting the standard for modern anti-hero dramas, the show paved the way for “prestige” television on basic cable with its raw, unflinching tone full of twists and thrills that explores the fine line between right and wrong. Over the course of 88 episodes, you’ll experience fast-paced action, moral ambiguity, high-stakes tension, and more riveting, gritty crime drama in one continuously solid storyline than you can stand. When viewing turns to obsession, don’t say I didn’t warn you. This one is a true gem.
Each of these hit criminal shows stands out for its realism and complexity, offering a much darker, thought-provoking take on crime storytelling that burrows into our brains and leaves us craving more. The platform has plenty of excellent crime dramas to choose from, so once you finish these three, stick around and see what else is there to transport you to the criminal underworld. Before you leave, though, be sure to check out everything coming to Prime Video in May 2026.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
June 01, 2026
