CMP Coming Soon EUVD-2026-84273

Requires an authenticated account with Editor-level capabilities or higher on a WordPress site running the CMP - Coming Soon & Maintenance plugin by NiteoThemes at version 4.1.17 or earlier; the vulnerable 'cmp_ajax_import_settings' AJAX handler is reachable in the plugin's default state (no non-default configuration needed). Exploitation is limited by the authentication requirement (a hostile or compromised Editor+ account) but needs no user interaction and works remotely over the network. Full impact (admin takeover) additionally depends on the attacker being able to register a new account after flipping the default_role and users_can_register options, which the flaw itself enables.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) is internally consistent with the description: network-reachable AJAX action, low complexity, no user interaction, but requiring authentication. PR:H is a defensible mapping of the stated 'Editor-level access and above' prerequisite (Wordfence conventionally scores Editor as high-privilege). The C:H/I:H/A:H is justified because the flaw allows updating arbitrary WordPress options - a full site takeover primitive (attacker flips default registration role to administrator and enables open registration). No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' This is a genuine privilege-escalation-to-admin issue, but the PR:H gate (a hostile or compromised Editor account is already required) meaningfully limits real-world urgency versus an unauthenticated flaw - the primary threat model is a malicious low-trust staff account or a hijacked Editor session escalating to full admin. No conflicting signals were detected; the main caveat is the absence of exploitation-probability telemetry (EPSS/KEV) to gauge in-the-wild activity.

An attacker holding an Editor-level account (or having hijacked one) on a WordPress site running CMP ≤4.1.17 sends a crafted request to the unprotected 'cmp_ajax_import_settings' AJAX action, which lacks a capability check. They set the WordPress 'default_role' option to administrator and enable 'users_can_register', then self-register a new account that is granted administrator privileges - full site compromise. No public exploit code is identified in the provided data.