What is the CVSS score of CVE-2026-6518?

CVE-2026-6518 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Cmp Coming Soon Maintenance Plugin By Niteothemes are affected by CVE-2026-6518?

The CMP - Coming Soon & Maintenance Plugin for WordPress (versions ≤4.1.16) contains a critical remote code execution vulnerability that allows WordPress administrators to upload and execute…

How to fix or mitigate CVE-2026-6518?

Within 24 hours: Audit all WordPress administrator accounts for unauthorized access or activity; disable the CMP plugin immediately or uninstall if unused. Within 7 days: Review WordPress user access logs and database for suspicious file uploads or modifications; implement strict administrator account access controls and multi-factor authentication (MFA) for all administrator users. Within 30 days: Monitor vendor (NiteoThemes) for a patched version ≥4.1.17; test and deploy the patch as soon as available; consider alternative maintenance/coming-soon plugins if the vendor does not release a patch within 60 days.

Cmp Coming Soon Maintenance Plugin By Niteothemes CVE-2026-6518

EUVD-2026-23654 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-04-18 Wordfence

WordPress RCE File Upload Cmp Coming Soon Maintenance Plugin By Niteothemes Wordpress Plugin

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 18, 2026 - 05:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 18, 2026 - 05:22 vuln.today

cvss_changed

Analysis Generated

Apr 18, 2026 - 04:42 vuln.today

EUVD ID Assigned

Apr 18, 2026 - 04:30 euvd

EUVD-2026-23654

Analysis Generated

Apr 18, 2026 - 04:30 vuln.today

CVE Published

Apr 18, 2026 - 03:37 nvd

HIGH 8.8

DescriptionCVE.org

The CMP - Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to arbitrary file upload and remote code execution in all versions up to, and including, 4.1.16 via the cmp_theme_update_install AJAX action. This is due to the function only checking for the publish_pages capability (available to Editors and above) instead of manage_options (Administrators only), combined with a lack of proper validation on the user-supplied file URL and no verification of the downloaded file's content before extraction. This makes it possible for authenticated attackers, with Administrator-level access and above, to force the server to download and extract a malicious ZIP file from a remote attacker-controlled URL into a web-accessible directory (wp-content/plugins/cmp-premium-themes/), resulting in remote code execution. Due to the lack of a nonce for Editors, they are unable to exploit this vulnerability.

AnalysisAI

Remote code execution in CMP - Coming Soon & Maintenance Plugin by NiteoThemes for WordPress (versions ≤4.1.16) allows authenticated attackers with Administrator-level privileges to upload and execute arbitrary PHP code via a malicious ZIP file. The vulnerability stems from insufficient capability checking (publish_pages instead of manage_options) and absent file validation in the cmp_theme_update_install AJAX action. CVSS 8.8 reflects high impact across confidentiality, integrity, and availability. No CISA KEV listing or public exploit code identified at time of analysis, suggesting limited real-world exploitation despite the high severity rating. Wordfence Threat Intelligence disclosed this vulnerability with detailed source code references.

Technical ContextAI

This vulnerability exists in the CMP - Coming Soon & Maintenance Plugin by NiteoThemes, a WordPress plugin used to display maintenance or coming-soon pages. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type). The vulnerable cmp_theme_update_install AJAX action implements incorrect capability checking by requiring only publish_pages (available to Editor role and above) rather than manage_options (Administrator-only). The function accepts a user-supplied URL parameter pointing to a remote ZIP file, downloads it without validating the source or inspecting the archive contents, then extracts it directly into wp-content/plugins/cmp-premium-themes/, a web-accessible directory. Because WordPress executes PHP files in plugin directories, an attacker can achieve arbitrary code execution by including malicious PHP scripts in the ZIP archive. The source code references (lines 1421, 1437, 1447 in niteo-cmp.php v4.1.16) show the vulnerable implementation. While the description mentions Editors have insufficient privileges due to missing nonce protection, the primary attack vector targets Administrators who can bypass all controls.

RemediationAI

Upgrade to CMP - Coming Soon & Maintenance Plugin by NiteoThemes version 4.1.17 or later immediately. The vendor-released patch is confirmed in the WordPress plugin repository changeset comparing 4.1.16 to 4.1.17 (https://plugins.trac.wordpress.org/changeset?old_path=%2Fcmp-coming-soon-maintenance/tags/4.1.16&new_path=%2Fcmp-coming-soon-maintenance/tags/4.1.17). Update can be performed through the WordPress admin dashboard under Plugins → Installed Plugins by selecting Update for CMP plugin. If immediate patching is not feasible, implement compensating controls: (1) Audit and minimize the number of Administrator-level accounts, removing unnecessary elevated privileges; (2) Enable WordPress admin login monitoring and alerting to detect suspicious authentication patterns; (3) Implement Web Application Firewall (WAF) rules to block POST requests to /wp-admin/admin-ajax.php with action=cmp_theme_update_install from untrusted Administrator sessions, though this may break legitimate theme update functionality requiring testing in staging environments first; (4) Review wp-content/plugins/cmp-premium-themes/ directory for unexpected files or recently modified PHP scripts as indicators of compromise. Compensating controls provide limited protection since authenticated administrators have legitimate access to admin-ajax.php endpoints. Patching remains the only complete remediation.