Cmp Coming Soon Maintenance Plugin By Niteothemes EUVD-2026-23654

Requires authenticated access with WordPress Administrator role credentials. The vulnerability exists in the cmp_theme_update_install AJAX action which checks for publish_pages capability, but practical exploitation requires Administrator privileges because Editor-level users cannot exploit due to missing CSRF nonce validation that blocks their requests. The CMP - Coming Soon & Maintenance Plugin by NiteoThemes must be installed and active (versions ≤4.1.16). No special server configuration or non-default plugin settings are required-default installation is vulnerable. Attack vector is network-based (AV:N) with low attack complexity (AC:L) and no user interaction required (UI:N) once Administrator session is established. Exploitation is LIMITED by the requirement for valid Administrator credentials, which are typically protected by authentication mechanisms, making this primarily a post-compromise or insider threat vector rather than an initial access vulnerability. Defenders should note this is NOT exploitable by unauthenticated attackers or low-privileged WordPress users (Subscribers, Contributors, Authors, Editors).

Real-world risk assessment requires balancing multiple signals. CVSS 8.8 (AV:N/AC:L/PR:L/UI:N) indicates network-exploitable vulnerability with low complexity requiring only low-privileged (authenticated) access. However, the description clarifies that despite the PR:L rating, exploitation realistically requires Administrator-level access due to nonce protection preventing Editor abuse. This significantly reduces the attack surface compared to the CVSS score's implication of low-privilege exploitation. No CISA KEV listing exists, indicating no confirmed active exploitation campaigns. No public proof-of-concept code identified in available references. EPSS data not provided but would likely be low given the authentication requirement and lack of observed exploitation. The vulnerability represents a privilege boundary violation (Administrators with legitimate access can perform unauthorized actions) rather than a privilege escalation. Primary risk scenarios involve compromised Administrator accounts, malicious insiders, or supply-chain attacks where an authenticated Administrator account is leveraged. The fix in version 4.1.17 (referenced in changeset diff) suggests vendor acknowledgment and remediation. Priority should be HIGH for sites with multiple Administrator accounts or shared hosting environments, MEDIUM for tightly controlled single-administrator installations where account compromise is less likely.

An attacker who has compromised an Administrator account (through credential theft, session hijacking, or social engineering) authenticates to the WordPress admin panel. They craft a malicious ZIP archive containing a PHP webshell (e.g., simple command execution script) and host it on an attacker-controlled server. The attacker sends an AJAX POST request to /wp-admin/admin-ajax.php with action=cmp_theme_update_install and a URL parameter pointing to the malicious ZIP file. The vulnerable plugin downloads and extracts the archive into wp-content/plugins/cmp-premium-themes/ without validation. The attacker then directly accesses the uploaded webshell via HTTP (e.g., https://victim-site.com/wp-content/plugins/cmp-premium-themes/shell.php) and executes arbitrary system commands with the privileges of the web server user, achieving full remote code execution. No public proof-of-concept code exists, but exploitation complexity is low for attackers with Administrator credentials.