A flaw in the WP Maps Pro plugin reportedly lets unauthenticated visitors create administrator accounts, turning a mapping helper into a potential site-takeover path.