EUVD-2026-84273
GHSA-wchw-wpj2-8j67
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network AJAX action, low complexity, no interaction; Editor-and-above requirement maps to PR:H; arbitrary option overwrite enabling admin takeover justifies C:H/I:H/A:H, scope unchanged as impact stays within the WordPress instance.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The CMP - Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'cmp_ajax_import_settings' AJAX action in all versions up to, and including, 4.1.17. This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Articles & Coverage 1
AnalysisAI
Privilege escalation in the CMP - Coming Soon & Maintenance plugin by NiteoThemes for WordPress, affecting all versions up to and including 4.1.17, lets authenticated attackers with Editor-level access or above rewrite arbitrary WordPress options through the unprotected 'cmp_ajax_import_settings' AJAX action. By pointing the site's default_role at administrator and switching on users_can_register, the attacker can self-register a brand-new administrative account and take full control of the site; the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, base 7.2) confirms network-reachable, low-complexity exploitation that requires a valid high-privilege session but no user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated account with Editor-level capabilities or higher on a WordPress site running the CMP - Coming Soon & Maintenance plugin by NiteoThemes at version 4.1.17 or earlier; the vulnerable 'cmp_ajax_import_settings' AJAX handler is reachable in the plugin's default state (no non-default configuration needed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) is internally consistent with the description: network-reachable AJAX action, low complexity, no user interaction, but requiring authentication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Primary fix: update the CMP - Coming Soon & Maintenance plugin past the affected 4.1.17 ceiling - upstream fix available (WordPress.org plugin repository changeset 3661069); released patched version not independently confirmed, so install the current version offered in the WordPress.org plugin directory and verify with the vendor changelog at https://plugins.trac.wordpress.org/changeset?reponame=&old=3661069%40cmp-coming-soon-maintenance&new=3661069%40cmp-coming-soon-maintenance before closing the ticket. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations for the CMP - Coming Soon & Maintenance plugin and identify any version up to and including 4.1.17; if the plugin is not essential, disable and remove it, and restrict Editor and higher roles to trusted accounts only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today