Cmp Coming Soon Maintenance Plugin By Niteothemes
Monthly
Privilege escalation in the CMP - Coming Soon & Maintenance plugin by NiteoThemes for WordPress, affecting all versions up to and including 4.1.17, lets authenticated attackers with Editor-level access or above rewrite arbitrary WordPress options through the unprotected 'cmp_ajax_import_settings' AJAX action. By pointing the site's default_role at administrator and switching on users_can_register, the attacker can self-register a brand-new administrative account and take full control of the site; the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, base 7.2) confirms network-reachable, low-complexity exploitation that requires a valid high-privilege session but no user interaction. Remediation status: upstream fix available (WordPress.org plugin repository changeset); released patched version not independently confirmed. Exploitation status: no public exploit identified at time of analysis.
Remote code execution in CMP - Coming Soon & Maintenance Plugin by NiteoThemes for WordPress (versions ≤4.1.16) allows authenticated attackers with Administrator-level privileges to upload and execute arbitrary PHP code via a malicious ZIP file. The vulnerability stems from insufficient capability checking (publish_pages instead of manage_options) and absent file validation in the cmp_theme_update_install AJAX action. CVSS 8.8 reflects high impact across confidentiality, integrity, and availability. No CISA KEV listing or public exploit code identified at time of analysis, suggesting limited real-world exploitation despite the high severity rating. Wordfence Threat Intelligence disclosed this vulnerability with detailed source code references.
Privilege escalation in the CMP - Coming Soon & Maintenance plugin by NiteoThemes for WordPress, affecting all versions up to and including 4.1.17, lets authenticated attackers with Editor-level access or above rewrite arbitrary WordPress options through the unprotected 'cmp_ajax_import_settings' AJAX action. By pointing the site's default_role at administrator and switching on users_can_register, the attacker can self-register a brand-new administrative account and take full control of the site; the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, base 7.2) confirms network-reachable, low-complexity exploitation that requires a valid high-privilege session but no user interaction. Remediation status: upstream fix available (WordPress.org plugin repository changeset); released patched version not independently confirmed. Exploitation status: no public exploit identified at time of analysis.
Remote code execution in CMP - Coming Soon & Maintenance Plugin by NiteoThemes for WordPress (versions ≤4.1.16) allows authenticated attackers with Administrator-level privileges to upload and execute arbitrary PHP code via a malicious ZIP file. The vulnerability stems from insufficient capability checking (publish_pages instead of manage_options) and absent file validation in the cmp_theme_update_install AJAX action. CVSS 8.8 reflects high impact across confidentiality, integrity, and availability. No CISA KEV listing or public exploit code identified at time of analysis, suggesting limited real-world exploitation despite the high severity rating. Wordfence Threat Intelligence disclosed this vulnerability with detailed source code references.