EUVD-2026-23654Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
The CMP - Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to arbitrary file upload and remote code execution in all versions up to, and including, 4.1.16 via the cmp_theme_update_install AJAX action. This is due to the function only checking for the publish_pages capability (available to Editors and above) instead of manage_options (Administrators only), combined with a lack of proper validation on the user-supplied file URL and no verification of the downloaded file's content before extraction. This makes it possible for authenticated attackers, with Administrator-level access and above, to force the server to download and extract a malicious ZIP file from a remote attacker-controlled URL into a web-accessible directory (wp-content/plugins/cmp-premium-themes/), resulting in remote code execution. Due to the lack of a nonce for Editors, they are unable to exploit this vulnerability.
AnalysisAI
Remote code execution in CMP - Coming Soon & Maintenance Plugin by NiteoThemes for WordPress (versions ≤4.1.16) allows authenticated attackers with Administrator-level privileges to upload and execute arbitrary PHP code via a malicious ZIP file. The vulnerability stems from insufficient capability checking (publish_pages instead of manage_options) and absent file validation in the cmp_theme_update_install AJAX action. CVSS 8.8 reflects high impact across confidentiality, integrity, and availability. No CISA KEV listing or public exploit code identified at time of analysis, suggesting limited real-world exploitation despite the high severity rating. Wordfence Threat Intelligence disclosed this vulnerability with detailed source code references.
Technical ContextAI
This vulnerability exists in the CMP - Coming Soon & Maintenance Plugin by NiteoThemes, a WordPress plugin used to display maintenance or coming-soon pages. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type). The vulnerable cmp_theme_update_install AJAX action implements incorrect capability checking by requiring only publish_pages (available to Editor role and above) rather than manage_options (Administrator-only). The function accepts a user-supplied URL parameter pointing to a remote ZIP file, downloads it without validating the source or inspecting the archive contents, then extracts it directly into wp-content/plugins/cmp-premium-themes/, a web-accessible directory. Because WordPress executes PHP files in plugin directories, an attacker can achieve arbitrary code execution by including malicious PHP scripts in the ZIP archive. The source code references (lines 1421, 1437, 1447 in niteo-cmp.php v4.1.16) show the vulnerable implementation. While the description mentions Editors have insufficient privileges due to missing nonce protection, the primary attack vector targets Administrators who can bypass all controls.
RemediationAI
Upgrade to CMP - Coming Soon & Maintenance Plugin by NiteoThemes version 4.1.17 or later immediately. The vendor-released patch is confirmed in the WordPress plugin repository changeset comparing 4.1.16 to 4.1.17 (https://plugins.trac.wordpress.org/changeset?old_path=%2Fcmp-coming-soon-maintenance/tags/4.1.16&new_path=%2Fcmp-coming-soon-maintenance/tags/4.1.17). Update can be performed through the WordPress admin dashboard under Plugins → Installed Plugins by selecting Update for CMP plugin. If immediate patching is not feasible, implement compensating controls: (1) Audit and minimize the number of Administrator-level accounts, removing unnecessary elevated privileges; (2) Enable WordPress admin login monitoring and alerting to detect suspicious authentication patterns; (3) Implement Web Application Firewall (WAF) rules to block POST requests to /wp-admin/admin-ajax.php with action=cmp_theme_update_install from untrusted Administrator sessions, though this may break legitimate theme update functionality requiring testing in staging environments first; (4) Review wp-content/plugins/cmp-premium-themes/ directory for unexpected files or recently modified PHP scripts as indicators of compromise. Compensating controls provide limited protection since authenticated administrators have legitimate access to admin-ajax.php endpoints. Patching remains the only complete remediation.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today