CMP WordPress Plugin CVE-2026-13415

Two simultaneous conditions must be met: (1) the target WordPress site must be running CMP plugin version 4.1.17 or earlier; (2) a WordPress administrator must have explicitly granted Editor-role users access to CMP's admin-bar controls - this is not a default WordPress or CMP configuration and requires a deliberate administrative action. The attacker must hold a valid Editor-role account on the target site (CVSS PR:H). SSVC rates the attack as not automatable, ruling out opportunistic mass exploitation. Limiting factors: valid Editor credentials required, non-default admin grant of CMP access required, and no confirmed public exploit simplifying the attack. Absent the CMP access grant to Editor users, the attack surface does not exist even on unpatched installations.

The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H produces a score of 7.2, reflecting network reachability but high-privilege prerequisites. The PR:H rating captures that the attacker must hold a WordPress Editor account with CMP admin-bar access explicitly granted by an administrator - a non-default condition. EPSS at 0.13% (3rd percentile) is extremely low, indicating negligible observed exploitation activity. SSVC corroborates this: exploitation is rated 'none' and automatable is 'no', meaning mass-scanning campaigns are not viable. Despite these suppressing signals, SSVC technical impact is 'total' because a successful exploit grants full administrative control. There is no conflict between signals here - high CVSS C/I/A reflects worst-case post-exploitation impact, while low EPSS and SSVC 'none' correctly describe current real-world exploitation likelihood. No KEV listing and no confirmed POC further support treating this as a patch-priority rather than an emergency-response issue.

An attacker holding a WordPress Editor account on a site where an administrator has granted Editor-role users access to CMP's admin-bar controls crafts a POST request to the CMP settings-import AJAX endpoint, supplying an arbitrary WordPress option key - such as the default user role or admin email - and a malicious value. The plugin writes the value to wp_options without validation, allowing the attacker to elevate their own account to Administrator or create a secondary admin-level user. No public exploit code has been identified at time of analysis.