What’s Vulnerable › Vulnerabilities
CVE-2026-13415: CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Privilege Escalation via cmp_ajax_import_settings
- Severity: high (CVSS 7.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-27 · updated 2026-08-28
- Weakness: CWE-269
Description
The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to update arbitrary WordPress options, including options that lead to privilege escalation to Administrator.
Affected products
- niteo CMP – Coming Soon & Maintenance Plugin by NiteoThemes: before 4.1.18 — fixed in 4.1.18
How to fix
Upgrade to a fixed version: niteo CMP – Coming Soon & Maintenance Plugin by NiteoThemes 4.1.18. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-13415 or the next vulnerability affects your stack