EUVD-2026-23654CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
The CMP - Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to arbitrary file upload and remote code execution in all versions up to, and including, 4.1.16 via the cmp_theme_update_install AJAX action. This is due to the function only checking for the publish_pages capability (available to Editors and above) instead of manage_options (Administrators only), combined with a lack of proper validation on the user-supplied file URL and no verification of the downloaded file's content before extraction. This makes it possible for authenticated attackers, with Administrator-level access and above, to force the server to download and extract a malicious ZIP file from a remote attacker-controlled URL into a web-accessible directory (wp-content/plugins/cmp-premium-themes/), resulting in remote code execution. Due to the lack of a nonce for Editors, they are unable to exploit this vulnerability.
AnalysisAI
Remote code execution in CMP - Coming Soon & Maintenance Plugin by NiteoThemes for WordPress (versions ≤4.1.16) allows authenticated attackers with Administrator-level privileges to upload and execute arbitrary PHP code via a malicious ZIP file. The vulnerability stems from insufficient capability checking (publish_pages instead of manage_options) and absent file validation in the cmp_theme_update_install AJAX action. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Audit all WordPress administrator accounts for unauthorized access or activity; disable the CMP plugin immediately or uninstall if unused. Within 7 days: Review WordPress user access logs and database for suspicious file uploads or modifications; implement strict administrator account access controls and multi-factor authentication (MFA) for all administrator users. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today