Description

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'cmp_ajax_import_settings' AJAX action in all versions up to, and including, 4.1.17. This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-22T06:16:48.700Z",
  "pubdate": "2026-09-22T06:16:48.700Z",
  "executiveSummary": "The CMP – Coming Soon & Maintenance Plugin by NiteoThemes is susceptible to an unauthorized data modification vulnerability.\nThis security flaw, affecting all versions up to and including 4.1.17, stems from a missing capability check on the 'cmp_ajax_import_settings' AJAX action.\nThe vulnerability allows authenticated users with Editor-level access or higher to perform unauthorized modifications to arbitrary WordPress site options.\nBy manipulating global settings, an attacker can modify the 'default_role' option to 'administrator' and enable the 'users_can_register' setting.\nThis creates a direct path for privilege escalation, permitting an attacker to register a new account with administrative privileges, thereby gaining full control over the compromised WordPress installation.\nThe risk to the confidentiality, integrity, and availability of the affected system is critical, as it bypasses standard access control mechanisms.",
  "technicalDetails": "The root cause of this vulnerability is an improper access control implementation within the plugin's AJAX handler. Specifically, the 'cmp_ajax_import_settings' function fails to verify the requesting user's authorization level before executing the settings import routine.\nWordPress AJAX actions should implement a robust check using current_user_can() to ensure the caller possesses the appropriate administrative permissions. In this implementation, the absence of this validation allows any user with a lower privilege level (such as an Editor) to interact with the function.\nThe attack flow commences when an authenticated attacker transmits a crafted HTTP POST request to the WordPress admin-ajax.php endpoint. The request must target the 'cmp_ajax_import_settings' action and include the necessary POST parameters containing a serialized or structured payload intended to overwrite existing site options.\nOnce the request is processed, the backend executes the vulnerable logic, which proceeds to update the 'wp_options' table. By injecting malicious key-value pairs, the attacker can systematically modify critical settings that govern site behavior.\nA primary exploitation vector involves the attacker updating the 'users_can_register' option to '1' and changing the 'default_role' option to 'administrator'. Following this modification, the attacker can navigate to the standard WordPress registration page (e.g., wp-login.php?action=register). Upon registering a new account, the platform assigns the user the administrative role by default due to the altered settings.\nThe post-exploitation impact is severe, granting the attacker full administrative capabilities over the WordPress instance. This includes the ability to install malicious plugins, modify existing themes, inject arbitrary PHP code, exfiltrate sensitive database information, or pivot within the hosting environment.\nThis vulnerability is restricted to environments where the user is already authenticated as an Editor. However, given that many WordPress installations grant Editor roles to contributors or site managers, the attack surface remains significant in multi-user environments.\nThere is no indication of complex network requirements; standard HTTP/HTTPS accessibility to the admin-ajax.php file is sufficient for successful exploitation."
}